CVE-2018-8037
Fixed in a distro release EPSS 11%
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.10 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.32 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | apache-commons-collections | 3.2.2-10.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | apache-commons-collections | 3.2.2-10.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | apache-commons-lang | 2.6-21.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | apache-commons-lang | 2.6-21.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | bea-stax-api | 1.2.0-16.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | bea-stax-api | 1.2.0-16.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | glassfish-jaxb-core | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | glassfish-jaxb-core | 2.2.11-11.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | glassfish-jaxb-runtime | 2.2.11-11.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | glassfish-jaxb-runtime | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | glassfish-jaxb-txw2 | 2.2.11-11.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | glassfish-jaxb-txw2 | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | javassist | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | javassist | 3.18.1-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | javassist-javadoc | 3.18.1-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | javassist-javadoc | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | python-nss-doc | 1.0.1-10.module_el8.5.0+150+5f0dbea0.alma |
| AlmaLinux 8 | python-nss-doc | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| AlmaLinux 8 | python3-nss | 1.0.1-10.module_el8.5.0+150+5f0dbea0.alma |
| AlmaLinux 8 | python3-nss | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| AlmaLinux 8 | relaxngDatatype | 2011.1-7.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | relaxngDatatype | 2011.1-7.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | slf4j | 1.7.25-4.module_el8.6.0+2752+f1f3449e |
| AlmaLinux 8 | slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | slf4j-jdk14 | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | slf4j-jdk14 | 1.7.25-4.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | stax-ex | 1.7.7-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | stax-ex | 1.7.7-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | velocity | 1.7-24.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | velocity | 1.7-24.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | xalan-j2 | 2.7.1-38.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | xalan-j2 | 2.7.1-38.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | xerces-j2 | 2.11.0-34.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | xerces-j2 | 2.11.0-34.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | xml-commons-apis | 1.4.01-25.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | xml-commons-apis | 1.4.01-25.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | xml-commons-resolver | 1.2-26.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | xml-commons-resolver | 1.2-26.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | xmlstreambuffer | 1.5.4-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux 8 | xmlstreambuffer | 1.5.4-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | xsom | 0-19.20110809svn.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux 8 | xsom | 0-19.20110809svn.module_el8.5.0+2577+9e95fe00 |
| Debian 9 | tomcat8 | 8.5.14-1+deb9u3 |
| Red Hat Enterprise Linux 8 | apache-commons-collections | 0:3.2.2-10.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | apache-commons-lang | 0:2.6-21.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | bea-stax | 0:1.2.0-16.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | bea-stax-api | 0:1.2.0-16.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | glassfish-fastinfoset | 0:1.2.13-9.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | glassfish-jaxb | 0:2.2.11-11.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | glassfish-jaxb-api | 0:2.2.12-8.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | glassfish-jaxb-core | 0:2.2.11-11.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | glassfish-jaxb-runtime | 0:2.2.11-11.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | glassfish-jaxb-txw2 | 0:2.2.11-11.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | jackson-annotations | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | jackson-core | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | jackson-databind | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | jackson-jaxrs-json-provider | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | jackson-jaxrs-providers | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | jackson-module-jaxb-annotations | 0:2.7.6-4.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | javassist | 0:3.18.1-8.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | javassist-javadoc | 0:3.18.1-8.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | pki-servlet-4.0-api | 1:9.0.7-14.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | pki-servlet-container | 1:9.0.7-14.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | python-nss | 0:1.0.1-10.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | python-nss-debugsource | 0:1.0.1-10.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | python-nss-doc | 0:1.0.1-10.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | python3-nss | 0:1.0.1-10.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | python3-nss-debuginfo | 0:1.0.1-10.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | relaxngDatatype | 0:2011.1-7.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | resteasy | 0:3.0.26-3.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | slf4j | 0:1.7.25-4.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | slf4j-jdk14 | 0:1.7.25-4.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | stax-ex | 0:1.7.7-8.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | velocity | 0:1.7-24.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | xalan-j2 | 0:2.7.1-38.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | xerces-j2 | 0:2.11.0-34.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | xml-commons-apis | 0:1.4.01-25.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | xml-commons-resolver | 0:1.2-26.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | xmlstreambuffer | 0:1.5.4-8.module+el8.0.0+3248+9d514f3b |
| Red Hat Enterprise Linux 8 | xsom | 0:0-19.20110809svn.module+el8.0.0+3248+9d514f3b |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-admin-webapps | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-admin-webapps | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-docs-webapp | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-docs-webapp | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-el-3.0-api | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-el-3.0-api | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-javadoc | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-javadoc | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-jsp-2.3-api | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-jsp-2.3-api | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-jsvc | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-jsvc | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-lib | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-lib | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-selinux | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-selinux | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-servlet-4.0-api | 0:9.0.7-12.redhat_12.1.el7jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-servlet-4.0-api | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-webapps | 0:9.0.7-12.redhat_12.1.el6jws |
| Red Hat jboss enterprise web server 5.0 | jws5-tomcat-webapps | 0:9.0.7-12.redhat_12.1.el7jws |
| Rocky Linux 8 | apache-commons-collections | 0:3.2.2-10.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | apache-commons-collections | 0:3.2.2-10.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | apache-commons-lang | 0:2.6-21.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | apache-commons-lang | 0:2.6-21.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | bea-stax | 0:1.2.0-16.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | glassfish-fastinfoset | 0:1.2.13-9.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | glassfish-jaxb | 0:2.2.11-11.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | glassfish-jaxb-api | 0:2.2.12-8.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | jackson-module-jaxb-annotations | 0:2.7.6-4.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | javassist | 0:3.18.1-8.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | javassist | 0:3.18.1-8.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | python-nss | 0:1.0.1-10.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | relaxngDatatype | 0:2011.1-7.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | resteasy | 0:3.0.26-3.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | slf4j | 0:1.7.25-4.module+el8.5.0+697+f586bb30 |
| Rocky Linux 8 | slf4j | 0:1.7.25-4.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | slf4j | 0:1.7.25-4.module+el8.3.0+133+b8b54b58 |
| Rocky Linux 8 | stax-ex | 0:1.7.7-8.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | velocity | 0:1.7-24.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | velocity | 0:1.7-24.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | xalan-j2 | 0:2.7.1-38.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | xalan-j2 | 0:2.7.1-38.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | xerces-j2 | 0:2.11.0-34.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | xerces-j2 | 0:2.11.0-34.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | xml-commons-apis | 0:1.4.01-25.module+el8.5.0+697+f586bb30 |
| Rocky Linux 8 | xml-commons-apis | 0:1.4.01-25.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | xml-commons-apis | 0:1.4.01-25.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | xml-commons-resolver | 0:1.2-26.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | xml-commons-resolver | 0:1.2-26.module+el8.3.0+74+855e3f5d |
| Rocky Linux 8 | xmlstreambuffer | 0:1.5.4-8.module+el8.3.0+53+ea062990 |
| Rocky Linux 8 | xsom | 0:0-19.20110809svn.module+el8.3.0+53+ea062990 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | tomcat | 9.0.10-3.7.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | tomcat | 8.0.53-10.35.1 |
| SUSE Linux Enterprise Server 12 SP3 | tomcat | 8.0.53-29.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | tomcat | 8.0.53-10.35.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | tomcat | 8.0.53-29.13.1 |
| Ubuntu 18.04 LTS | tomcat8 | 8.5.39-1ubuntu1~18.04.1 |
| openSUSE Tumbleweed | tomcat | 9.0.36-8.4 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 |