If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jakarta-commons-httpclientUpgrade apache-commons-langUpgrade python-nss-docUpgrade bea-stax-apiUpgrade stax-exUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade python3-nssUpgrade velocityUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade javassistUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade xmlstreambufferUpgrade xsomUpgrade relaxngDatatypeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade xalan-j2Upgrade xerces-j2Upgrade xml-commons-resolver | May 13, 2022 | Aug 2, 2018 |
| Amazon_linux | — | Upgrade tomcat8 | Aug 11, 2018 | Aug 2, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.32Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.10 | Aug 2, 2018 | Aug 2, 2018 |
| Centos_linux | — | Upgrade python-nss-docUpgrade relaxngDatatypeUpgrade python-nss-debugsourceUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade python3-nss-debuginfoUpgrade jackson-coreUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade slf4jUpgrade javassist-javadocUpgrade python3-nssUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade velocityUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade resteasyUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade pki-servlet-containerUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade stax-exUpgrade xerces-j2 | Aug 28, 2019 | Aug 2, 2018 |
| Debian | — | Upgrade tomcat9Upgrade tomcat8 | Aug 30, 2018 | Aug 2, 2018 |
| Oracle Solaris | — | Upgrade library/perl-5/database to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-522 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-526 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-27 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-526 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-522 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/client to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser to version 5.12.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-526 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-526 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/desktop-startup to version 0.38.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/mailman to version 2.1.29.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-526 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-526 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-522 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/gdm to version 3.24.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-522 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/library to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-35 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-522 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-522 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-522 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3/documentation to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-522 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-526 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-526 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/speech/espeak to version 1.44.0.5-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-526 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/dotconf to version 1.3-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam to version 5.8.4-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade image/library/libjpeg to version 6.0.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-522 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/speech-dispatcher to version 0.8.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade database/mysql-57 to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-522 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-526 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade database/mysql-57/tests to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-522 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-526 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/webkitgtk4 to version 2.18.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-526 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/wireshark-common to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-526 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-526 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-522 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/tshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-34 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-522 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-526 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/liblouis to version 3.5.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-522 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/embedded to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-522 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-526 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-522 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-526 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade web/curl to version 7.61.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-522 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4 | Aug 24, 2018 | Aug 2, 2018 |
| Oracle_linux | — | Upgrade slf4j-jdk14Upgrade velocityUpgrade stax-exUpgrade jackson-coreUpgrade pki-servlet-containerUpgrade jackson-jaxrs-providersUpgrade relaxngDatatypeUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade jackson-annotationsUpgrade resteasyUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-langUpgrade python3-nssUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade xsomUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade xalan-j2Upgrade xmlstreambufferUpgrade jakarta-commons-httpclient | Jul 22, 2024 | Jul 22, 2018 |
| Redhat_linux | — | Upgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade python3-nss-debuginfoUpgrade xmlstreambufferUpgrade xsomUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-langUpgrade javassistUpgrade python-nss-docUpgrade xml-commons-apisUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade pki-servlet-containerUpgrade velocityUpgrade bea-stax-api | Jun 19, 2019 | Aug 2, 2018 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Aug 2, 2018 |
| Suse | — | Upgrade tomcat-embedUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-3_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-lib | Sep 14, 2018 | Aug 2, 2018 |
| Ubuntu | — | Upgrade tomcat8 | Nov 19, 2024 | Aug 2, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 2, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub