Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 602454 (CVE-2016-8745) - <www-servers/tomcat-{7.0.75,8.0.41,8.5.9}: Information Disclosure
Summary: <www-servers/tomcat-{7.0.75,8.0.41,8.5.9}: Information Disclosure
Status: RESOLVED FIXED
Alias: CVE-2016-8745
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://seclists.org/oss-sec/2016/q4/654
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-12 17:07 UTC by Thomas Deutschmann
Modified: 2017-05-09 16:58 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann gentoo-dev Security 2016-12-12 17:07:38 UTC
CVE-2016-8745 Apache Tomcat Information Disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M13
Apache Tomcat 8.5.0 to 8.5.8
Earlier versions are not affected.

Description
The refactoring of the Connector code for 8.5.x onwards introduced a
regression in the error handling of the send file code for the NIO HTTP
connector. An error during send file processing resulted in the current
Processor object being added to the Processor cache multiple times. This
in turn meant that the same Processor could be used for concurrent
requests. Sharing a Processor can result in information leakage between
requests including, not not limited to, session ID and the response body.

Mitigation
Users of the NIO HTTP connector with the affected versions should apply
one of the following mitigations
- Switch to the NIO2 HTTP or APR HTTP connector
- Disable send file
- Upgrade to Apache Tomcat 9.0.0.M15 or later
  (Apache Tomcat 9.0.0.M14 has the fix but was not released)
- Upgrade to Apache Tomcat 8.5.9 or later

Credit:
This issue was reported publicly as Bug 60409 [1] and the security
implications identified by the Tomcat security team.

References:
[1] https://bz.apache.org/bugzilla/show_bug.cgi?id=60409
[2] http://tomcat.apache.org/security-9.html
[3] http://tomcat.apache.org/security-8.html
Comment 1 Thomas Deutschmann gentoo-dev Security 2016-12-12 17:10:08 UTC
We already have v8.5.9 in tree. Because this branch was never stable and no stable branch was affected, no need for stabilization at all.


@ Maintainer(s): Please cleanup 8.5.x and 9.0.x branch.
Comment 2 Thomas Deutschmann gentoo-dev Security 2017-01-06 12:40:36 UTC
Upstream updated the adivsory, and added the following affected versions:

- Apache Tomcat 8.0.0.RC1 to 8.0.39 (new)
- Apache Tomcat 7.0.0 to 7.0.73 (new)
- Apache Tomcat 6.0.16 to 6.0.48 (new)


Full updated advisory (from http://www.openwall.com/lists/oss-security/2017/01/05/3):
CVE-2016-8745 Apache Tomcat Information Disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M13
Apache Tomcat 8.5.0 to 8.5.8
Apache Tomcat 8.0.0.RC1 to 8.0.39 (new)
Apache Tomcat 7.0.0 to 7.0.73 (new)
Apache Tomcat 6.0.16 to 6.0.48 (new)

Description
A bug in the error handling of the send file code for the NIO HTTP
connector resulted in the current Processor object being added to the
Processor cache multiple times. This in turn meant that the same
Processor could be used for concurrent requests. Sharing a Processor can
result in information leakage between requests including, not not
limited to, session ID and the response body.
The bug was first noticed in 8.5.x onwards where it appears the
refactoring of the Connector code for 8.5.x onwards made it more likely
that the bug was observed. Initially it was thought that the 8.5.x
refactoring introduced the bug but further investigation has shown that
the bug is present in all currently supported Tomcat versions.

Mitigation:
Users of the NIO HTTP connector with the affected versions should apply
one of the following mitigations
- Switch to the BIO HTTP, NIO2 HTTP or APR HTTP connector
- Disable send file
- Upgrade to Apache Tomcat 9.0.0.M15 or later
  (Apache Tomcat 9.0.0.M14 has the fix but was not released)
- Upgrade to Apache Tomcat 8.5.9 or later
- Upgrade to Apache Tomcat 8.0.40 or later when released
- Upgrade to Apache Tomcat 7.0.74 or later when released
- Upgrade to Apache Tomcat 6.0.49 or later when released

Credit:
This issue was reported publicly as Bug 60409 [1] and the security
implications identified by the Tomcat security team.

History:
2016-12-12 Original advisory
2017-01-04 Updated information on affected versions

References:
[1] https://bz.apache.org/bugzilla/show_bug.cgi?id=60409
[2] http://tomcat.apache.org/security-9.html
[3] http://tomcat.apache.org/security-8.html
[3] http://tomcat.apache.org/security-7.html
[3] http://tomcat.apache.org/security-6.html
Comment 3 Agostino Sarubbo gentoo-dev 2017-01-11 14:17:32 UTC
7.0.74 and 6.0.49 were not released
Comment 4 Miroslav Šulc gentoo-dev 2017-05-09 14:26:01 UTC
8.5.9 is not in the tree anymore
Comment 5 Thomas Deutschmann gentoo-dev Security 2017-05-09 16:58:22 UTC
GLSA Vote: No

Repository is clean, all done.

Maintainer(s), Thank you for your work.