The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8 | Aug 5, 2022 | May 13, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.76Upgrade Apache Tomcat to 9.0.21Upgrade Apache Tomcat to the latest available version | May 13, 2022 | May 13, 2022 |
| Centos_linux | — | Upgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade javassistUpgrade jss-javadocUpgrade python3-nss-debuginfoUpgrade tomcatjssUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade pki-toolsUpgrade pki-serverUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade pki-caUpgrade pki-kraUpgrade python-nss-debugsourceUpgrade pki-base-javaUpgrade jakarta-commons-httpclientUpgrade jss-debugsourceUpgrade jackson-annotationsUpgrade jss-debuginfoUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade jackson-coreUpgrade apache-commons-netUpgrade xsomUpgrade pki-core-debuginfoUpgrade jssUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade xmlstreambufferUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade python3-nssUpgrade ldapjdk-javadocUpgrade pki-core-debugsourceUpgrade jackson-databindUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-apiUpgrade xerces-j2Upgrade python3-pkiUpgrade stax-exUpgrade python-nss-docUpgrade pki-baseUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade xml-commons-resolverUpgrade velocityUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providers | Aug 24, 2022 | May 13, 2022 |
| Debian | — | Upgrade tomcat9 | Jul 30, 2024 | May 13, 2022 |
| Redhat_linux | — | Upgrade python3-nss-debuginfoUpgrade jss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade jssUpgrade velocityUpgrade xml-commons-resolverUpgrade python-nss-debugsourceUpgrade apache-commons-collectionsUpgrade pki-core-debuginfoUpgrade xsomUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-kraUpgrade pki-caUpgrade pki-servlet-4.0-apiNo solution existsUpgrade python3-nssUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade jackson-coreUpgrade pki-core-debugsourceUpgrade pki-toolsUpgrade jackson-jaxrs-providersUpgrade pki-symkey-debuginfoUpgrade pki-servlet-engineUpgrade javassist-javadocUpgrade resteasyUpgrade apache-commons-netUpgrade tomcatjssUpgrade glassfish-jaxb-txw2Upgrade pki-base-javaUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade xml-commons-apisUpgrade pki-tools-debuginfoUpgrade ldapjdk-javadocUpgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade slf4jUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade xerces-j2Upgrade ldapjdkUpgrade pki-serverUpgrade jackson-annotationsUpgrade jackson-databindUpgrade glassfish-fastinfosetUpgrade jss-debugsourceUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-json-provider | Aug 24, 2022 | May 13, 2022 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsource | Mar 12, 2024 | May 13, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub