{"containers": {"cna": {"affected": [{"product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "9.0.0.M1 to 9.0.0.M13"}, {"status": "affected", "version": "8.5.0 to 8.5.8"}, {"status": "affected", "version": "8.0.0.RC1 to 8.0.39"}, {"status": "affected", "version": "7.0.0 to 7.0.73"}, {"status": "affected", "version": "6.0.16 to 6.0.48"}]}], "datePublic": "2017-01-05T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-13T16:10:06.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"name": "94828", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/94828"}, {"name": "1037432", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1037432"}, {"name": "GLSA-201705-09", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201705-09"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20180607-0002/"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"}, {"name": "RHSA-2017:0935", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:0935"}, {"name": "DSA-3754", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2017/dsa-3754"}, {"name": "RHSA-2017:0457", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0457.html"}, {"name": "DSA-3755", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2017/dsa-3755"}, {"name": "RHSA-2017:0455", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:0455"}, {"name": "RHSA-2017:0527", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0527.html"}, {"name": "RHSA-2017:0456", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:0456"}, {"name": "[announce] 20170105 [SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "DATE_PUBLIC": "2017-01-05T00:00:00", "ID": "CVE-2016-8745", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Tomcat", "version": {"version_data": [{"version_value": "9.0.0.M1 to 9.0.0.M13"}, {"version_value": "8.5.0 to 8.5.8"}, {"version_value": "8.0.0.RC1 to 8.0.39"}, {"version_value": "7.0.0 to 7.0.73"}, {"version_value": "6.0.16 to 6.0.48"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "94828", "refsource": "BID", "url": "http://www.securityfocus.com/bid/94828"}, {"name": "1037432", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1037432"}, {"name": "GLSA-201705-09", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201705-09"}, {"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"name": "https://security.netapp.com/advisory/ntap-20180607-0002/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20180607-0002/"}, {"name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"}, {"name": "RHSA-2017:0935", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:0935"}, {"name": "DSA-3754", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3754"}, {"name": "RHSA-2017:0457", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2017-0457.html"}, {"name": "DSA-3755", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3755"}, {"name": "RHSA-2017:0455", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:0455"}, {"name": "RHSA-2017:0527", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2017-0527.html"}, {"name": "RHSA-2017:0456", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:0456"}, {"name": "[announce] 20170105 [SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4@%3Cannounce.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T02:35:00.119Z"}, "title": "CVE Program Container", "references": [{"name": "94828", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/94828"}, {"name": "1037432", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1037432"}, {"name": "GLSA-201705-09", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201705-09"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20180607-0002/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"}, {"name": "RHSA-2017:0935", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:0935"}, {"name": "DSA-3754", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2017/dsa-3754"}, {"name": "RHSA-2017:0457", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0457.html"}, {"name": "DSA-3755", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2017/dsa-3755"}, {"name": "RHSA-2017:0455", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:0455"}, {"name": "RHSA-2017:0527", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0527.html"}, {"name": "RHSA-2017:0456", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:0456"}, {"name": "[announce] 20170105 [SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2023-12-12T21:20:42.661869Z", "id": "CVE-2016-8745", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-14T20:02:16.961Z"}}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2016-8745", "datePublished": "2017-08-10T22:00:00.000Z", "dateReserved": "2016-10-18T00:00:00.000Z", "dateUpdated": "2024-11-14T20:02:16.961Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.securityfocus.com/bid/94828", "name": "94828", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"]}, {"url": "http://www.securitytracker.com/id/1037432", "name": "1037432", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"]}, {"url": "https://security.gentoo.org/glsa/201705-09", "name": "GLSA-201705-09", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"]}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20180607-0002/", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2017:0935", "name": "RHSA-2017:0935", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "http://www.debian.org/security/2017/dsa-3754", "name": "DSA-3754", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"]}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0457.html", "name": "RHSA-2017:0457", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "http://www.debian.org/security/2017/dsa-3755", "name": "DSA-3755", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2017:0455", "name": "RHSA-2017:0455", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0527.html", "name": "RHSA-2017:0527", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2017:0456", "name": "RHSA-2017:0456", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E", "name": "[announce] 20170105 [SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T02:35:00.119Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2016-8745", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2023-12-12T21:20:42.661869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-14T20:02:10.669Z"}}], "cna": {"affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "9.0.0.M1 to 9.0.0.M13"}, {"status": "affected", "version": "8.5.0 to 8.5.8"}, {"status": "affected", "version": "8.0.0.RC1 to 8.0.39"}, {"status": "affected", "version": "7.0.0 to 7.0.73"}, {"status": "affected", "version": "6.0.16 to 6.0.48"}]}], "datePublic": "2017-01-05T00:00:00.000Z", "references": [{"url": "http://www.securityfocus.com/bid/94828", "name": "94828", "tags": ["vdb-entry", "x_refsource_BID"]}, {"url": "http://www.securitytracker.com/id/1037432", "name": "1037432", "tags": ["vdb-entry", "x_refsource_SECTRACK"]}, {"url": "https://security.gentoo.org/glsa/201705-09", "name": "GLSA-201705-09", "tags": ["vendor-advisory", "x_refsource_GENTOO"]}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://security.netapp.com/advisory/ntap-20180607-0002/", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://access.redhat.com/errata/RHSA-2017:0935", "name": "RHSA-2017:0935", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "http://www.debian.org/security/2017/dsa-3754", "name": "DSA-3754", "tags": ["vendor-advisory", "x_refsource_DEBIAN"]}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0457.html", "name": "RHSA-2017:0457", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "http://www.debian.org/security/2017/dsa-3755", "name": "DSA-3755", "tags": ["vendor-advisory", "x_refsource_DEBIAN"]}, {"url": "https://access.redhat.com/errata/RHSA-2017:0455", "name": "RHSA-2017:0455", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0527.html", "name": "RHSA-2017:0527", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2017:0456", "name": "RHSA-2017:0456", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E", "name": "[announce] 20170105 [SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "tags": ["mailing-list", "x_refsource_MLIST"]}], "descriptions": [{"lang": "en", "value": "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Information Disclosure"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2020-02-13T16:10:06.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "9.0.0.M1 to 9.0.0.M13"}, {"version_value": "8.5.0 to 8.5.8"}, {"version_value": "8.0.0.RC1 to 8.0.39"}, {"version_value": "7.0.0 to 7.0.73"}, {"version_value": "6.0.16 to 6.0.48"}]}, "product_name": "Apache Tomcat"}]}, "vendor_name": "Apache Software Foundation"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/94828", "name": "94828", "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1037432", "name": "1037432", "refsource": "SECTRACK"}, {"url": "https://security.gentoo.org/glsa/201705-09", "name": "GLSA-201705-09", "refsource": "GENTOO"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "refsource": "CONFIRM"}, {"url": "https://security.netapp.com/advisory/ntap-20180607-0002/", "name": "https://security.netapp.com/advisory/ntap-20180607-0002/", "refsource": "CONFIRM"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html", "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html", "refsource": "CONFIRM"}, {"url": "https://access.redhat.com/errata/RHSA-2017:0935", "name": "RHSA-2017:0935", "refsource": "REDHAT"}, {"url": "http://www.debian.org/security/2017/dsa-3754", "name": "DSA-3754", "refsource": "DEBIAN"}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0457.html", "name": "RHSA-2017:0457", "refsource": "REDHAT"}, {"url": "http://www.debian.org/security/2017/dsa-3755", "name": "DSA-3755", "refsource": "DEBIAN"}, {"url": "https://access.redhat.com/errata/RHSA-2017:0455", "name": "RHSA-2017:0455", "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0527.html", "name": "RHSA-2017:0527", "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2017:0456", "name": "RHSA-2017:0456", "refsource": "REDHAT"}, {"url": "https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4@%3Cannounce.tomcat.apache.org%3E", "name": "[announce] 20170105 [SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", "refsource": "MLIST"}, {"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E", "name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/", "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-8745", "STATE": "PUBLIC", "ASSIGNER": "security@apache.org", "DATE_PUBLIC": "2017-01-05T00:00:00"}}}}, "cveMetadata": {"cveId": "CVE-2016-8745", "state": "PUBLISHED", "dateUpdated": "2024-11-14T20:02:16.961Z", "dateReserved": "2016-10-18T00:00:00.000Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2017-08-10T22:00:00.000Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0F8C62EF-1B67-456A-9C66-755439CF8556", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "A819E245-D641-4F19-9139-6C940504F6E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "8C381275-10C5-4939-BCE3-0D1F3B3CB2EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "7205475A-6D04-4042-B24E-1DA5A57029B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "08022987-B36B-4F63-88A5-A8F59195DF4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "FF4B7557-EF35-451E-B55D-3296966695AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "8980E61E-27BE-4858-82B3-C0E8128AF521", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "8756BF9B-3E24-4677-87AE-31CE776541F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "88CE057E-2092-4C98-8D0C-75CF439D0A9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "8F194580-EE6D-4E38-87F3-F0661262256B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "1F74A421-D019-4248-84B8-C70D4D9A8A95", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "05346F5A-FB52-4376-AAC7-9A5308216545", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "305688F2-50A6-41FB-8614-BC589DB9A789", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "D24AA431-C436-4AA5-85DF-B9AAFF2548FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "25966344-15D5-4101-9346-B06BFD2DFFF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "11F4CBAC-27B1-4EFF-955A-A63B457D0578", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "FD55B338-9DBE-4643-ABED-A08964D3AF7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*", "matchCriteriaId": "0D4F710E-06EA-48F4-AC6A-6F143950F015", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*", "matchCriteriaId": "2C4936C2-0B2D-4C44-98C3-443090965F5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*", "matchCriteriaId": "48453405-2319-4327-9F4C-6F70B49452C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*", "matchCriteriaId": "49DD9544-6424-41A6-AEC0-EC19B8A10E71", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*", "matchCriteriaId": "E4670E65-2E11-49A4-B661-57C2F60D411F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*", "matchCriteriaId": "5E8FF71D-4710-4FBB-9925-A6A26C450F7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*", "matchCriteriaId": "31002A23-4788-4BC7-AE11-A3C2AA31716D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*", "matchCriteriaId": "7144EDDF-8265-4642-8EEB-ED52527E0A26", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*", "matchCriteriaId": "DF06B5C1-B9DD-4673-A101-56E1E593ACDD", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*", "matchCriteriaId": "7D731065-626B-4425-8E49-F708DD457824", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*", "matchCriteriaId": "B3D850EA-E537-42C8-93B9-96E15CB26747", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "E037DA05-2BEF-4F64-B8BB-307247B6A05C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*", "matchCriteriaId": "BCAF1EB5-FB34-40FC-96ED-9D073890D8BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*", "matchCriteriaId": "D395D95B-1F4A-420E-A0F6-609360AF7B69", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*", "matchCriteriaId": "9BD221BA-0AB6-4972-8AD9-5D37AC07762F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*", "matchCriteriaId": "E55B6565-96CB-4F6A-9A80-C3FB82F30546", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*", "matchCriteriaId": "D3300AFE-49A4-4904-B9A0-5679F09FA01E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*", "matchCriteriaId": "ED5125CC-05F9-4678-90DB-A5C7CD24AE6F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*", "matchCriteriaId": "7BD93669-1B30-4BF8-AD7D-F60DD8D63CC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*", "matchCriteriaId": "1B904C74-B92E-4EAE-AE6C-78E2B844C3DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*", "matchCriteriaId": "B8C8C97F-6C9D-4647-AB8A-ADAA5536DDE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*", "matchCriteriaId": "2C6109D1-BC36-40C5-A02A-7AEBC949BAC0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*", "matchCriteriaId": "DA8A7333-B4C3-4876-AE01-62F2FD315504", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*", "matchCriteriaId": "92993E23-D805-407B-8B87-11CEEE8B212F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*", "matchCriteriaId": "7A11BD74-305C-41E2-95B1-5008EEF5FA5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*", "matchCriteriaId": "595442D0-9DB7-475A-AE30-8535B70E122E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*", "matchCriteriaId": "4B0BA92A-0BD3-4CE4-9465-95E949104BAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*", "matchCriteriaId": "6F944B72-B9EB-4EB8-AEA3-E0D7ADBE1305", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*", "matchCriteriaId": "6AA28D3A-3EE5-4F90-B8F5-4943F7607DA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*", "matchCriteriaId": "BFD3EB84-2ED2-49D4-8BC9-6398C2E46F0A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*", "matchCriteriaId": "DEDF6E1A-0DD6-42AB-9510-F6F4B6002C91", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*", "matchCriteriaId": "C947E549-2459-4AFB-84A7-36BDA30B5F29", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*", "matchCriteriaId": "5D55DF79-F9BE-4907-A4D8-96C4B11189ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*", "matchCriteriaId": "14AB5787-82D7-4F78-BE93-4556AB7A7D0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*", "matchCriteriaId": "F8E9453E-BC9B-4F77-85FA-BA15AC55C245", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*", "matchCriteriaId": "A7EF0518-73F9-47DB-8946-A8334936BEFF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*", "matchCriteriaId": "95AA8778-7833-4572-A71B-5FD89938CE94", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*", "matchCriteriaId": "242E47CE-EF69-4F8F-AB40-5AF2811674CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:*", "matchCriteriaId": "A225D4F7-174E-47C3-8390-C6FA28DB5A9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*", "matchCriteriaId": "CDA1555C-E55A-4E14-B786-BFEE3F09220B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:*", "matchCriteriaId": "6BAC42AE-B82A-4ABF-9519-B2D97D925707", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*", "matchCriteriaId": "F8075E9A-DA7F-4A0B-8B4D-0CD951369111", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*", "matchCriteriaId": "335A5320-6086-4B45-9903-82F6F92A584F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*", "matchCriteriaId": "46B33408-C2E2-4E7C-9334-6AB98F13468C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*", "matchCriteriaId": "9F036676-9EFB-4A92-828E-A38905D594E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*", "matchCriteriaId": "E9728EE8-6029-4DF3-942E-E4ACC09111A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:*", "matchCriteriaId": "62DBB843-288C-4060-8777-6CDCF1860D29", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*", "matchCriteriaId": "34E7DAC8-8419-45D1-A28F-14CF2FE1B6EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:*", "matchCriteriaId": "89B87EB5-4902-4C2A-878A-45185F7D0FA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:*", "matchCriteriaId": "C0596E6C-9ACE-4106-A2FF-BED7967C323F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:*", "matchCriteriaId": "8F7158DC-966B-4508-8600-40E3E9D3D0DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:*", "matchCriteriaId": "A190FE0D-86C1-49EE-BDAE-5879C32BDC92", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:*", "matchCriteriaId": "CA20F45F-01A2-43DD-9731-DFF54E31719F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:*", "matchCriteriaId": "3C7A728B-59DB-4EDE-8929-C91F4C410902", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "E6CE354B-36BE-4280-9D86-E3AC552E6D6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "4752862B-7D26-4285-B8A0-CF082C758353", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*", "matchCriteriaId": "58EA7199-3373-4F97-9907-3A479A02155E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F963D737-2E95-4D7C-92C7-DACF3F36D1E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "2BBBC5EA-012C-4C5D-A61B-BAF134B300DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "2A358FDF-C249-4D7A-9445-8B9E7D9D40AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "8C4DB619-F6B0-4896-9AE2-7E7D92105577", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "AFF96F96-34DB-4EB3-BF59-11220673FA26", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "44883383-6360-4BE6-9B48-1308F85E5797", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "EDF3E379-47D2-4C86-8C6D-8B3C25A0E1C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "E82391BD-10FF-4E7F-91DC-35AA11325530", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "92C22F12-C072-4A12-A4A9-CBF589A36FF1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "61E008F8-2F01-4DD8-853A-337B4B4163C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "6A776B25-6AF1-421B-8E47-2A7499F6B4D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "7A332FDE-42AE-4F48-9553-5AE953CD6D3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "701424A2-BB06-44B5-B468-7164E4F95529", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "1BA6388C-5B6E-4651-8AE3-EBCCF61C27E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "A63FA521-9D20-49B9-A9A4-0DF891B4E4E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "8F9A5B7E-33A9-4651-9BE1-371A0064B661", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "F99252E8-A59C-48E1-B251-718D7FB3E399", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "9D05293B-B9D8-42F1-9367-9D2E058EFAD5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "4E0DDEF6-A8EE-46C4-A046-A1F26E7C4E87", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "14B38892-9C00-4510-B7BA-F2A8F2CACCAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.19:*:*:*:*:*:*:*", "matchCriteriaId": "8C913AA6-2260-4249-BE1D-7139F45735D3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*", "matchCriteriaId": "7409B064-D43E-489E-AEC6-0A767FB21737", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*", "matchCriteriaId": "F019268F-80C4-48FE-8164-E9DA0A3BAFF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*", "matchCriteriaId": "1EFBD214-FCFE-4F04-A903-66EFDA764B9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*", "matchCriteriaId": "425D86B3-6BB9-410D-8125-F7CF87290AD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*", "matchCriteriaId": "3EE3BB0D-1002-41E4-9BE8-875D97330057", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.25:*:*:*:*:*:*:*", "matchCriteriaId": "25D0E80B-EDDA-4876-912D-44BFE6211EB0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*", "matchCriteriaId": "6622472B-8644-4D45-A54B-A215C3D64B83", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*", "matchCriteriaId": "B338F95B-2924-435B-827F-E64420A93244", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*", "matchCriteriaId": "209D1349-7740-4DBE-80A5-E6343C62BAB5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*", "matchCriteriaId": "09E77C24-C265-403D-A193-B3739713F6B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*", "matchCriteriaId": "28616FA3-9A98-4AAE-9F94-3E77A14156EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.31:*:*:*:*:*:*:*", "matchCriteriaId": "335925DA-11C0-4222-B6B7-82602B361751", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.32:*:*:*:*:*:*:*", "matchCriteriaId": "603A14BF-72BB-4A3D-8CBC-932DC45CEC06", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.33:*:*:*:*:*:*:*", "matchCriteriaId": "4C2E1C55-3C89-4F26-A981-1195BCC9BB5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.34:*:*:*:*:*:*:*", "matchCriteriaId": "FC242407-A447-4ABD-8E19-EB6DB1F35121", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.35:*:*:*:*:*:*:*", "matchCriteriaId": "31BB906B-812F-462C-9AEE-147C1418D865", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.36:*:*:*:*:*:*:*", "matchCriteriaId": "0B701E17-D231-44ED-A46E-C67749A725B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.37:*:*:*:*:*:*:*", "matchCriteriaId": "B8CAF2F7-D227-4F06-B0E6-533C5EDB105B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.38:*:*:*:*:*:*:*", "matchCriteriaId": "305B73CE-0224-4E73-8EB2-FC41A62FBA08", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.0.39:*:*:*:*:*:*:*", "matchCriteriaId": "D0DBF476-D7BB-4FC8-89FE-FF0CD135E9BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "69A7FC28-A0EC-4516-9776-700343D2F4DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "18814653-6D44-47D9-A2F5-89C5AFB255F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "D4D811A9-4988-4C11-AA27-F5BE2B93D8D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*", "matchCriteriaId": "FAEF824D-7E95-4BC1-8DBB-787DCE595E21", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*", "matchCriteriaId": "97F4A2B3-DB1D-4D0B-B5FF-7EE2A0D291BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*", "matchCriteriaId": "0B461D5A-1208-498F-B551-46C6D514AC2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*", "matchCriteriaId": "598E5D91-0165-4D55-9EDD-EBB5AAAD1172", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*", "matchCriteriaId": "4B6B61B7-09A3-41C8-8333-0417C14CC87E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*", "matchCriteriaId": "95A139BA-CD3C-42F5-88BA-BE7BE58246D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*", "matchCriteriaId": "9D0689FE-4BC0-4F53-8C79-34B21F9B86C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*", "matchCriteriaId": "89B129B2-FB6F-4EF9-BF12-E589A87996CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*", "matchCriteriaId": "8B6787B6-54A8-475E-BA1C-AB99334B2535", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*", "matchCriteriaId": "EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*", "matchCriteriaId": "E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*", "matchCriteriaId": "9F542E12-6BA8-4504-A494-DA83E7E19BD5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*", "matchCriteriaId": "C0C5F004-F7D8-45DB-B173-351C50B0EC16", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*", "matchCriteriaId": "D1902D2E-1896-4D3D-9E1C-3A675255072C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*", "matchCriteriaId": "49AAF4DF-F61D-47A8-8788-A21E317A145D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*", "matchCriteriaId": "454211D0-60A2-4661-AECA-4C0121413FEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*", "matchCriteriaId": "0686F977-889F-4960-8E0B-7784B73A7F2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*", "matchCriteriaId": "558703AE-DB5E-4DFF-B497-C36694DD7B24", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*", "matchCriteriaId": "ED6273F2-1165-47A4-8DD7-9E9B2472941B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions."}, {"lang": "es", "value": "Un fallo en el control de errores del c\u00f3digo de env\u00edo de archivo para el conector NIO HTTP en Apache Tomcat 9.0.0.M1 a 9.0.0.M13, 8.5.0 a 8.5.8, 8.0.0.RC1 a 8.0.39, 7.0.0 a 7.0.73 y 6.0.16 a 6.0.48 daba lugar a la adici\u00f3n del objeto Processor a la cach\u00e9 Processor varias veces. Esto significa que el mismo Processor podr\u00eda emplearse para peticiones simult\u00e1neas. Compartir un Processor puede desembocar en un filtrado de informaci\u00f3n entre peticiones incluyendo, pero sin limitarse al ID de sesi\u00f3n y el cuerpo de la respuesta. Este error se detect\u00f3 por primera vez en las versiones 8.5.x en adelante, donde parece que la refactorizaci\u00f3n del c\u00f3digo Connector para las versiones 8.5.x en adelante aumentaba la posibilidad de que se observase el error. Al principio, se pens\u00f3 que la refactorizaci\u00f3n de las versiones 8.5.x introdujo el error, pero investigaciones en mayor profundida han determinado que el error est\u00e1 presente en todas las versiones de Tomcat compatibles actualmente."}], "id": "CVE-2016-8745", "lastModified": "2026-05-13T00:24:29.033", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-08-10T22:29:00.267", "references": [{"source": "security@apache.org", "url": "http://rhn.redhat.com/errata/RHSA-2017-0457.html"}, {"source": "security@apache.org", "url": "http://rhn.redhat.com/errata/RHSA-2017-0527.html"}, {"source": "security@apache.org", "url": "http://www.debian.org/security/2017/dsa-3754"}, {"source": "security@apache.org", "url": "http://www.debian.org/security/2017/dsa-3755"}, {"source": "security@apache.org", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"}, {"source": "security@apache.org", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"source": "security@apache.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94828"}, {"source": "security@apache.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1037432"}, {"source": "security@apache.org", "url": "https://access.redhat.com/errata/RHSA-2017:0455"}, {"source": "security@apache.org", "url": "https://access.redhat.com/errata/RHSA-2017:0456"}, {"source": "security@apache.org", "url": "https://access.redhat.com/errata/RHSA-2017:0935"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"}, {"source": "security@apache.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://security.gentoo.org/glsa/201705-09"}, {"source": "security@apache.org", "url": "https://security.netapp.com/advisory/ntap-20180607-0002/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2017-0457.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2017-0527.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2017/dsa-3754"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2017/dsa-3755"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94828"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1037432"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2017:0455"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2017:0456"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2017:0935"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://security.gentoo.org/glsa/201705-09"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20180607-0002/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-388"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2017:0527", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "tomcat6-0:6.0.24-105.el6_8", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2017-03-15T00:00:00Z"}, {"advisory": "RHSA-2017:0935", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "tomcat-0:7.0.69-11.el7_3", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2017-04-12T00:00:00Z"}, {"advisory": "RHSA-2017:0457", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1", "product_name": "Red Hat JBoss Web Server 3.1", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "hibernate4-eap6-0:4.2.23-1.Final_redhat_1.1.ep6.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "jbcs-httpd24-0:1-3.jbcs.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "jbcs-httpd24-apache-commons-daemon-0:1.0.15-1.redhat_2.1.jbcs.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "jbcs-httpd24-apache-commons-daemon-jsvc-1:1.0.15-17.redhat_2.jbcs.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "mod_cluster-0:1.3.5-2.Final_redhat_2.1.ep7.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "tomcat7-0:7.0.70-16.ep7.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "tomcat8-0:8.0.36-17.ep7.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "tomcat-native-0:1.2.8-9.redhat_9.ep7.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0455", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6", "package": "tomcat-vault-0:1.0.8-9.Final_redhat_2.1.ep7.el6", "product_name": "Red Hat JBoss Web Server 3 for RHEL 6", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "hibernate4-eap6-0:4.2.23-1.Final_redhat_1.1.ep6.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "jbcs-httpd24-0:1-3.jbcs.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "jbcs-httpd24-apache-commons-daemon-0:1.0.15-1.redhat_2.1.jbcs.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "jbcs-httpd24-apache-commons-daemon-jsvc-1:1.0.15-17.redhat_2.jbcs.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "mod_cluster-0:1.3.5-2.Final_redhat_2.1.ep7.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "tomcat7-0:7.0.70-16.ep7.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "tomcat8-0:8.0.36-17.ep7.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "tomcat-native-0:1.2.8-9.redhat_9.ep7.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}, {"advisory": "RHSA-2017:0456", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package": "tomcat-vault-0:1.0.8-9.Final_redhat_2.1.ep7.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2017-03-07T00:00:00Z"}], "bugzilla": {"description": "tomcat: information disclosure due to incorrect Processor sharing", "id": "1403824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1403824"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "status": "verified"}, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "details": ["A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.", "A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body."], "name": "CVE-2016-8745", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "tomcat5", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:5", "fix_state": "Not affected", "package_name": "jbossweb", "product_name": "Red Hat JBoss BRMS 5"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:6", "fix_state": "Not affected", "package_name": "jbossweb", "product_name": "Red Hat JBoss Data Grid 6"}, {"cpe": "cpe:/a:redhat:jboss_data_virtualization:6", "fix_state": "Not affected", "package_name": "jbossweb", "product_name": "Red Hat JBoss Data Virtualization 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5", "fix_state": "Not affected", "package_name": "jbossweb", "product_name": "Red Hat JBoss Enterprise Application Platform 5"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Not affected", "package_name": "jbossweb", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2", "fix_state": "Will not fix", "package_name": "tomcat6", "product_name": "Red Hat JBoss Enterprise Web Server 2"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2", "fix_state": "Will not fix", "package_name": "tomcat7", "product_name": "Red Hat JBoss Enterprise Web Server 2"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Not affected", "package_name": "karaf", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6", "fix_state": "Not affected", "package_name": "jbossweb", "product_name": "Red Hat JBoss Fuse Service Works 6"}, {"cpe": "cpe:/a:redhat:jboss_operations_network:3", "fix_state": "Not affected", "package_name": "jbossweb", "product_name": "Red Hat JBoss Operations Network 3"}], "public_date": "2016-12-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2016-8745\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-8745\nhttps://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49\nhttps://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74\nhttps://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40\nhttps://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.9"], "threat_severity": "Important"}

{}