Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System. Security Fixes: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up CVE-2018-8037 tomcat: Insecure...

RLSA-2019:1529 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by Rocky Enterprise Software Foundation Certificate System. Security Fixes: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up...

pki-deps:10.6 security update

An update is available for glassfish-jaxb-api, glassfish-fastinfoset, xalan-j2, xmlstreambuffer, apache-commons-lang, jackson-module-jaxb-annotations, apache-commons-collections, javassist, python-nss, bea-stax, velocity, xml-commons-apis, resteasy, xsom, slf4j, stax-ex, xerces-j2,...

ALSA-2019:1529 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System. Security Fixes: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up CVE-2018-8037 tomcat: Insecure...

openSUSE Security Update : tomcat (openSUSE-2019-770)

This update for tomcat to version 9.0.10 fixes the following issues : Security issues fixed : - CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with supplementary characters could have lead to an infinite loop in the decoder causing a Denial of Service bsc1102400. -...

Fedora 28 : 1:tomcat (2018-b1832101b8)

This update includes a rebase from 8.5.30 up to 8.5.32 which resolves two CVEs along with various other bugs/features : - rhbz1579612 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins - rhbz1607586 CVE-2018-8034 tomcat: host name verification...

Apache Tomcat 9.0.0.M1 < 9.0.10 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.10. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in WebSocket client because host name verification is missing - A flaw exists in NIO/NIO2 connectors due to a mishandling of close that can...

Apache Tomcat 8.5.0 < 8.5.32 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.32. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in WebSocket client because host name verification is missing - A flaw exists in NIO/NIO2 connectors due to a mishandling of close that can...

Apache Tomcat Race Condition vulnerability

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not...

CVE-2018-8037

CVE-2018-8037 affects Apache Tomcat 9.0.0.M9–9.0.9 and 8.5.5–8.5.31. The issue is a race condition where an async request completes as the container times out, plus a related NIO/NIO2 connector closure-tracking bug, which could cause a user to receive a response intended for another user. Impact ...

CVE-2018-8037

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not...

CVE-2018-8037: Concurrent Execution using Shared Resource with Improper Synchronization

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not...

Apache Tomcat 'NIO/NIO2' Connectors Information Disclosure Vulnerability - Windows

Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...

Apache Tomcat 'NIO/NIO2' Connectors Information Disclosure Vulnerability - Linux

Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...

Information Disclosure

tomcat is vulnerable to information disclosure attacks. The vulnerability exists due to the mishandling of close in the NIO and NIO2 connectors where user sessions can be mixed up, causing information disclosure...

Apache Tomcat 8.5.5 < 8.5.32 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.5.32. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.32security-8 advisory. - If an async request was completed by the application at the same time as the container triggered the...

PT-2018-3242

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.5 through 8.5.31 Apache Tomcat versions 9.0.0.M9 through 9.0.9 Description The issue is caused by synchronization errors when using a shared resource, which could allow a remote attacker to disclose protected...

Fixed in Apache Tomcat 9.0.10

Low: host name verification missing in WebSocket client CVE-2018-8034 The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. This was fixed in revision 1833757. This issue was reported publicly on 11 June 2018 and formally announced as a...