https://bugzilla.redhat.com/show_bug.cgi?id=1432006
Bug ID: 1432006 Summary: CVE-2016-8747 tomcat: Information leak between requests on the same connection Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: alee@redhat.com, csutherl@redhat.com, gzaronik@redhat.com, ivan.afonichev@gmail.com, java-sig-commits@lists.fedoraproject.org, jclere@redhat.com, krzysztof.daniel@gmail.com, lgao@redhat.com, mbabacek@redhat.com, me@coolsvap.net, myarboro@redhat.com, trick@vanstaveren.us, twalsh@redhat.com, weli@redhat.com
The refactoring to make wider use of ByteBuffer introduced a regression that could cause information to leak between requests on the same connection. When running behind a reverse proxy, this could result in information leakage between users. All HTTP connector variants are affected but HTTP/2 and AJP are not affected.
Fixed in https://svn.apache.org/viewvc?view=revision&revision=1774166
Affects: 8.5.7 to 8.5.9
https://bugzilla.redhat.com/show_bug.cgi?id=1432006
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |tomcat 8.5.11
https://bugzilla.redhat.com/show_bug.cgi?id=1432006
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG Last Closed| |2017-03-14 06:03:18
java-sig-commits@lists.fedoraproject.org