p PatchFirst

CVE-2018-8037

CVE-2018-8037

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.

CVSS 5.9 · Medium · EPSS 11.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • 9.0.0.M9 to 9.0.9: Affected
    • 8.5.5 to 8.5.31: Affected

    No fix published

  • tomcat8 Ubuntu:18.04:LTS

    Versions
    • 8.5.21-1ubuntu1
    • 8.5.29-1
    • 8.5.30-1
    • 8.5.30-1ubuntu1
    • 8.5.30-1ubuntu1.2
    • 8.5.30-1ubuntu1.3
    • 8.5.30-1ubuntu1.4
    Affected ranges
    • ECOSYSTEM: < 8.5.39-1ubuntu1~18.04.1

    Update to 8.5.39-1ubuntu1~18.04.1

Original sources

Check your server →