CVE-2016-8747: Infoleak
First published: Tue Mar 14 2017(Updated: )
An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Tomcat | =8.5.7 | |
| Apache Tomcat | =8.5.8 | |
| Apache Tomcat | =8.5.9 | |
| Apache Tomcat | =9.0.0-m11 | |
| Apache Tomcat | =9.0.0-m13 | |
| Apache Tomcat | =9.0.0-m15 | |
| Apache Tomcat | =9.0.0-milestone11 | |
| Apache Tomcat | =9.0.0-milestone13 | |
| Apache Tomcat | =9.0.0-milestone15 | |
| maven/org.apache.tomcat:tomcat | >=9.0.0.M11<=9.0.0.M15 | 9.0.0.M16 |
| maven/org.apache.tomcat:tomcat | >=8.5.7<=8.5.9 | 8.5.10 |
| =8.5.7 | ||
| =8.5.8 | ||
| =8.5.9 | ||
| =9.0.0-milestone11 | ||
| =9.0.0-milestone13 | ||
| =9.0.0-milestone15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://svn.apache.org/viewvc?view=revision&revision=1774161
- http://svn.apache.org/viewvc?view=revision&revision=1774166
- http://tomcat.apache.org/security-8.html
- http://tomcat.apache.org/security-9.html
- http://www.securityfocus.com/bid/96895
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20180614-0002/
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-8747
- https://web.archive.org/web/20200227183332/http://www.securityfocus.com/bid/96895
- https://github.com/advisories/GHSA-fjwp-r6fm-q6qw (Advisory)
- https://github.com/apache/tomcat/commit/452c8094a665ef6375530e81c033da4eeb2e4865
- https://github.com/apache/tomcat/commit/9601a937ff3b7ef5d04b2a0e950d0e44e1bb4cbd
- https://security.netapp.com/advisory/ntap-20180614-0002
- collector/nvd-index
- agent/type
- agent/remedy
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-fjwp-r6fm-q6qw
- alias/CVE-2016-8747
- agent/last-modified-date
- agent/event
- collector/nvd-cve
- collector/github-advisory
- agent/trending
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/8.5.7
- version/apache tomcat/8.5.8
- version/apache tomcat/8.5.9
- version/apache tomcat/9.0.0-m11
- version/apache tomcat/9.0.0-m13
- version/apache tomcat/9.0.0-m15
- version/apache tomcat/9.0.0-milestone11
- version/apache tomcat/9.0.0-milestone13
- version/apache tomcat/9.0.0-milestone15
- package-manager/maven