The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8 | Aug 5, 2022 | May 13, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.76Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.21 | May 13, 2022 | May 13, 2022 |
| Centos_linux | — | Upgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade jss-debuginfoUpgrade pki-caUpgrade pki-kraUpgrade xsomUpgrade apache-commons-netUpgrade javassist-javadocUpgrade pki-serverUpgrade glassfish-fastinfosetUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade python3-nss-debuginfoUpgrade tomcatjssUpgrade xml-commons-apisUpgrade javassistUpgrade resteasyUpgrade jss-debugsourceUpgrade xalan-j2Upgrade slf4jUpgrade jackson-coreUpgrade pki-base-javaUpgrade jakarta-commons-httpclientUpgrade relaxngDatatypeUpgrade pki-core-debuginfoUpgrade jss-javadocUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade pki-baseUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade bea-stax-apiUpgrade jackson-databindUpgrade pki-core-debugsourceUpgrade velocityUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade pki-servlet-engineUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade pki-symkey-debuginfoUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade pki-tools-debuginfoUpgrade xerces-j2Upgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade jssUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade pki-symkey | Aug 24, 2022 | May 13, 2022 |
| Debian | — | Upgrade tomcat9 | Jul 30, 2024 | May 13, 2022 |
| Redhat_linux | — | Upgrade xsomUpgrade velocityUpgrade pki-symkeyUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade jackson-jaxrs-providersUpgrade pki-caUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade stax-exUpgrade jss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade pki-core-debuginfoUpgrade python3-nssUpgrade jssUpgrade pki-kraUpgrade pki-toolsUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade pki-baseNo solution existsUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade glassfish-jaxb-apiUpgrade apache-commons-netUpgrade pki-symkey-debuginfoUpgrade resteasyUpgrade xerces-j2Upgrade javassist-javadocUpgrade tomcatjssUpgrade ldapjdk-javadocUpgrade xmlstreambufferUpgrade jss-javadocUpgrade slf4jUpgrade javassistUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade jss-debugsourceUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade jackson-databindUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade pki-serverUpgrade ldapjdkUpgrade xalan-j2Upgrade pki-tools-debuginfoUpgrade jakarta-commons-httpclientUpgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade apache-commons-lang | Aug 24, 2022 | May 13, 2022 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | May 13, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub