If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8 | Aug 5, 2022 | May 13, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.21Upgrade Apache Tomcat to 8.5.76 | May 13, 2022 | May 13, 2022 |
| Centos_linux | — | Upgrade glassfish-jaxb-coreUpgrade ldapjdkUpgrade bea-stax-apiUpgrade jssUpgrade python-nss-docUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade ldapjdk-javadocUpgrade pki-tools-debuginfoUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade jackson-jaxrs-providersUpgrade jackson-databindUpgrade pki-servlet-engineUpgrade slf4j-jdk14Upgrade velocityUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade python3-pkiUpgrade xmlstreambufferUpgrade pki-symkeyUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade pki-symkey-debuginfoUpgrade apache-commons-collectionsUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-debugsourceUpgrade xml-commons-apisUpgrade python3-nss-debuginfoUpgrade javassistUpgrade resteasyUpgrade relaxngDatatypeUpgrade pki-core-debuginfoUpgrade pki-base-javaUpgrade jss-javadocUpgrade jakarta-commons-httpclientUpgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade pki-serverUpgrade pki-kraUpgrade pki-caUpgrade jackson-annotationsUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade jackson-coreUpgrade javassist-javadocUpgrade xsomUpgrade jss-debuginfoUpgrade jss-debugsourceUpgrade slf4jUpgrade apache-commons-netUpgrade tomcatjss | Aug 24, 2022 | May 13, 2022 |
| Debian | — | Upgrade tomcat9 | Jul 30, 2024 | May 13, 2022 |
| Redhat_linux | — | Upgrade jssUpgrade pki-caUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade pki-kraUpgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiNo solution existsUpgrade pki-core-debugsourceUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade pki-symkeyUpgrade apache-commons-collectionsUpgrade jss-debuginfoUpgrade xsomUpgrade pki-toolsUpgrade velocityUpgrade pki-core-debuginfoUpgrade stax-exUpgrade javassist-javadocUpgrade pki-servlet-engineUpgrade relaxngDatatypeUpgrade jss-debugsourceUpgrade jackson-annotationsUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade bea-stax-apiUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade pki-tools-debuginfoUpgrade python3-pkiUpgrade apache-commons-netUpgrade resteasyUpgrade tomcatjssUpgrade xerces-j2Upgrade glassfish-jaxb-apiUpgrade jss-javadocUpgrade ldapjdk-javadocUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade slf4jUpgrade xml-commons-apisUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade apache-commons-langUpgrade ldapjdkUpgrade pki-server | Aug 24, 2022 | May 13, 2022 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | May 13, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub