https://bugzilla.redhat.com/show_bug.cgi?id=1432006
Bug ID: 1432006
Summary: CVE-2016-8747 tomcat: Information leak between
requests on the same connection
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: alee(a)redhat.com, csutherl(a)redhat.com,
gzaronik(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net,
myarboro(a)redhat.com, trick(a)vanstaveren.us,
twalsh(a)redhat.com, weli(a)redhat.com
The refactoring to make wider use of ByteBuffer introduced a regression that
could cause information to leak between requests on the same connection. When
running behind a reverse proxy, this could result in information leakage
between users. All HTTP connector variants are affected but HTTP/2 and AJP are
not affected.
Fixed in
https://svn.apache.org/viewvc?view=revision&revision=1774166
Affects: 8.5.7 to 8.5.9
--
You are receiving this mail because:
You are on the CC list for the bug.