If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8 | Aug 5, 2022 | May 13, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.76Upgrade Apache Tomcat to 9.0.21Upgrade Apache Tomcat to the latest available version | May 13, 2022 | May 13, 2022 |
| Centos_linux | — | Upgrade resteasyUpgrade jss-debugsourceUpgrade pki-toolsUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade jackson-annotationsUpgrade slf4jUpgrade jackson-coreUpgrade pki-serverUpgrade javassist-javadocUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade javassistUpgrade apache-commons-netUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade pki-kraUpgrade jss-javadocUpgrade pki-caUpgrade xml-commons-apisUpgrade xsomUpgrade jss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade pki-base-javaUpgrade pki-core-debuginfoUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade tomcatjssUpgrade glassfish-jaxb-apiUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade python3-pkiUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade stax-exUpgrade pki-servlet-engineUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade jssUpgrade python3-nssUpgrade pki-tools-debuginfoUpgrade pki-core-debugsourceUpgrade jackson-databindUpgrade pki-symkeyUpgrade xerces-j2Upgrade velocityUpgrade xml-commons-resolver | Aug 24, 2022 | May 13, 2022 |
| Debian | — | Upgrade tomcat9 | Jul 30, 2024 | May 13, 2022 |
| Redhat_linux | — | Upgrade pki-symkeyUpgrade velocityUpgrade apache-commons-collectionsUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade pki-caUpgrade jackson-coreUpgrade python3-nssUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade jss-debuginfoUpgrade slf4j-jdk14Upgrade xsomUpgrade stax-exUpgrade jssUpgrade pki-toolsNo solution existsUpgrade xml-commons-resolverUpgrade python3-nss-debuginfoUpgrade pki-core-debuginfoUpgrade python-nss-debugsourceUpgrade pki-servlet-4.0-apiUpgrade pki-kraUpgrade glassfish-jaxb-runtimeUpgrade resteasyUpgrade jackson-databindUpgrade xmlstreambufferUpgrade javassist-javadocUpgrade apache-commons-langUpgrade ldapjdkUpgrade glassfish-fastinfosetUpgrade jss-debugsourceUpgrade jackson-annotationsUpgrade pki-serverUpgrade jakarta-commons-httpclientUpgrade pki-tools-debuginfoUpgrade bea-stax-apiUpgrade tomcatjssUpgrade xalan-j2Upgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade jss-javadocUpgrade ldapjdk-javadocUpgrade javassistUpgrade pki-symkey-debuginfoUpgrade xml-commons-apisUpgrade apache-commons-netUpgrade xerces-j2Upgrade relaxngDatatype | Aug 24, 2022 | May 13, 2022 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | May 13, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub