A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "7.0.0"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.1"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.2"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.3"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.4"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.5"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.6"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.7"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.8"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.9"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.11"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.12"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.13"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.14"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.15"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.16"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.17"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.18"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.19"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.20"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.21"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.22"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.23"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.24"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.25"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.26"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.27"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.28"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.29"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.30"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.31"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.32"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.33"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.34"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.35"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.36"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.37"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.38"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.39"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.40"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.41"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.42"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.43"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.44"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.45"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.46"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.47"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.48"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.49"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.50"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.52"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.53"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.54"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.55"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.56"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.57"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.58"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.59"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.60"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.61"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.62"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.63"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.64"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.65"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.66"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.67"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.68"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.69"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.70"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.71"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.72"
},
{
"introduced": "0"
},
{
"last_affected": "7.0.73"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.0"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.1"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.2"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.3"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.4"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.5"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.6"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.7"
},
{
"introduced": "0"
},
{
"last_affected": "8.5.8"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone1"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone10"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone11"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone12"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone13"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone2"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone3"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone4"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone5"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone6"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone7"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone8"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-milestone9"
}
]
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-8745.json"
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.0-rc1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.0-rc10"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.0-rc3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.0-rc5"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.5"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.6"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.7"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.8"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.9"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.10"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.11"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.12"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.13"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.14"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.15"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.16"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.17"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.18"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.19"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.20"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.21"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.22"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.23"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.24"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.25"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.26"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.27"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.28"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.29"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.30"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.31"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.32"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.33"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.34"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.35"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.36"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.37"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.38"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0.39"
}
]
}
]