Apache Tomcat Information Disclosure Vulnerability (CVE-2016-8745)

10.4.62.91 10.4.62.92 10.4.62.93 10.4.62.94

Apache Tomcat Information Disclosure Vulnerability cve-2016-8745: Remote WWW Service information can be obtained via HTTP

Date: 2016-12-12

Importance: Important

The affected version:

Apache Tomcat 9.0.0.m1 to 9.0.0.m13

Apache Tomcat 8.5.0 to 8.5.8

Earlier versions are unaffected

Describe:

The 8.5.x Connector code refactoring introduces a regression in the error-handling code that sends files to the NIO HTTP connector, so processing a send file error causes the current processor object to be added multiple times to the processor cache, which means that the processor can be used for concurrent requests, A shared processor can cause information disclosure between requests, including but not limited to the session ID and response body.

Solution:

Users who have installed the affected version of the NIO HTTP Connector can take the following steps to resolve:

Switch to NIO2 HTTP or APR HTTP connector

Prohibit sending files

Upgrade to Apache Tomcat 9.0.0.M15 or later (Apache Tomcat 9.0.0.M14 has been repaired but not released)

Upgrade to Apache Tomcat 8.5.9 or later

Relist

Description: I upgraded to version 8.5.11 successfully resolved this vulnerability.

This article is from "Dream Dreams" blog, please be sure to keep this source http://dreamy.blog.51cto.com/12471447/1898203

Apache Tomcat Information Disclosure Vulnerability (CVE-2016-8745)