CVE-2018-8037: Race Condition
Flaw affecting tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31. A bug in the tracking of connection closures can lead to reuse of user sessions in a new connection.
Upstream patch:
http://svn.apache.org/viewvc?view=rev&rev=1833906 http://svn.apache.org/viewvc?view=rev&rev=1833907
References:
https://tomcat.apache.org/security-8.html https://tomcat.apache.org/security-9.html
Other sources
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jws5-tomcatto a version that resolves this vulnerability.Fixed in 0:9.0.7-12.redhat_12.1.el6 - Upgrade
Upgrade
redhat/jws5-tomcatto a version that resolves this vulnerability.Fixed in 0:9.0.7-12.redhat_12.1.el7 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.31-1~deb10u6Fixed in 9.0.31-1~deb10u10Fixed in 9.0.43-2~deb11u6Fixed in 9.0.43-2~deb11u9Fixed in 9.0.70-2 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 9.0.10 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.5.32 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.32 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 9.0.10 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.87 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.9 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 8.5.31
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2018-8037?
CVE-2018-8037 is a vulnerability in Apache Tomcat that could result in a race condition and allow a user to see a response intended for a different user.
What is the severity of CVE-2018-8037?
CVE-2018-8037 has a severity rating of 9.1, which is considered critical.
Which versions of Apache Tomcat are affected by CVE-2018-8037?
Apache Tomcat versions 8.5.32 to 8.5.31 and versions 9.0.10 to 9.0.9 are affected by CVE-2018-8037.
How can I fix CVE-2018-8037?
To fix CVE-2018-8037, update to Apache Tomcat version 8.5.32 or 9.0.10 or later.
Where can I find more information about CVE-2018-8037?
You can find more information about CVE-2018-8037 on the Apache Tomcat official website and in the provided references.