Apache Tomcat vulnerabilities

Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50, and 7.0.98 to 7.0.99 contain a regression that causes invalid Transfer-Encoding headers to be incorrectly processed, leading to a possibility of HTTP Request Smuggling if Tomcat is behind a reverse proxy that incorrectly handles the invalid Transfer-Encoding header in a particular manner.

In Apache Tomcat versions 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49, and 7.0.0 to 7.0.98, when using FORM authentication, there is a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for practical exploitation, but it has been treated as a security vulnerability out of caution.

A malicious web application running on Apache Tomcat versions from 6.0.0 to 9.0.0.M9 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

The ResourceLinkFactory implementation in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

In Apache Tomcat versions from 6.0.0 to 9.0.0.M9, a vulnerability allowed a malicious web application to bypass a configured SecurityManager via a Tomcat utility method accessible to web applications.

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

In Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, a regression in send file processing was introduced. If the send file processing completed quickly, it was possible for the same Processor to be added to the processor cache twice.

In Apache Tomcat versions from 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75, there was an issue with the use of the incorrect facade object in some calls to application listeners. This allowed untrusted applications to retain a reference to the request or response object, potentially accessing or modifying information associated with another web application.

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

Apache Tomcat before 6.0.39, 7.0.50, and 8.0.0-RC10 allows attackers to obtain Tomcat internals information by leveraging an untrusted web application with XML documents containing external entity declarations, related to an XML External Entity (XXE) issue.

Apache Tomcat before 6.0.39, 7.0.50, and 8.0.0-RC10 processes chunked transfer coding without properly handling large amounts of chunked data or whitespace characters in HTTP header values within trailer fields, allowing remote attackers to cause a denial of service by streaming data. This vulnerability exists due to an incomplete fix for CVE-2012-3544.

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers. This allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via multiple Content-Length headers or a Content-Length header and a "Transfer-Encoding: chunked" header.

The FormAuthenticator in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, allowing remote attackers to inject a request into a session by sending this request during completion of the login form. This is a variant of a session fixation attack.

Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding. This allows remote attackers to cause a denial of service by streaming data.

Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 has a vulnerability in NioEndpoint.java when the NIO connector is used with sendfile and HTTPS. A remote attacker can cause an infinite loop (denial of service) by terminating the connection during response reading.

The CsrfPreventionFilter in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials. This makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, making it easier for remote attackers to bypass authentication via vectors related to the session ID.

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce values instead of nonce and nc values, making it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. This is a different vulnerability than CVE-2011-1184.

Improper handling of length parameter inconsistency in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. Affects versions from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121; also known affected: 8.5.0-8.5.100 and 7.0.56-7.0.109.

A vulnerability in Apache Tomcat causes lost timeouts for asynchronous WebSocket writes, leading to denial of service (DoS). The issue affects many Tomcat versions, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121.

A vulnerability in Apache Tomcat related to incomplete cleanup can cause a malformed request to potentially (depending on timing) cause one request from another user to fail. Affects versions 11.0.19-11.0.25, 10.1.53-10.1.59, and 9.0.116-9.0.121.

A vulnerability in Apache Tomcat involving uncontrolled resource allocation allows an unauthenticated AJP request to pin an AJP processing thread, leading to denial of service. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M1-9.0.121.

A vulnerability in Apache Tomcat involving uncontrolled resource consumption during sending of WebSocket close message enables a DoS attack. Affects versions 11.0.0-M5-11.0.25, 10.1.8-10.1.59, and 9.0.74-9.0.121.

A vulnerability in Apache Tomcat involving a race condition allows an attacker to inject trailer fields into another HTTP/2 request. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.39-9.0.121.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. Affects versions: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. Known affected EOL versions: 8.5.67 through 8.5.100. Recommended upgrade to 11.0.26, 10.1.60 or 9.0.122.

A vulnerability in Apache Tomcat related to improper authentication. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use that provider, the realm for the first web application to authenticate a request will be used for all web applications. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M4-9.0.121.

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100.

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSocket session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset.

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) a user would be authenticated even if the user did not exist in the DataSourceRealm.

Improper Authorization vulnerability in Apache Tomcat caused by security-role-ref definitions being incorrectly used as role aliases within the Realm in addition to the correct usage with Request.isUserInRole().

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.

Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorized local user to access the socket. Affects versions from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.42 through 9.0.120.

In Apache Tomcat, the WebSocket chat example has an uncontrolled resource consumption vulnerability. Affected versions: 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120.

A missing critical step in authentication was found in Apache Tomcat's JNDIRealm when configured to use GSSAPI. Attackers can authenticate without providing the correct password.

An improper authorization vulnerability in Apache Tomcat causes security constraints for the default servlet to ignore any configured HTTP method or method omission. This affects Tomcat versions from 7.0.0 through 11.0.22.

A vulnerability in Apache Tomcat allows a replay attack against the EncryptionInterceptor in the cluster component. The issue stems from improper authentication, enabling an attacker to reuse intercepted data.

An Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve causes subsequent non-OR conditions to be skipped if the first condition in an OR chain matches.

A basic XSS (Cross-Site Scripting) vulnerability was found in the number guess example application in Apache Tomcat. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code.

Apache Tomcat has an improper resource shutdown or release vulnerability. If an error occurs during multipart upload processing, temporary copies of uploaded parts are not cleaned up immediately but left for garbage collection, potentially leading to disk space exhaustion and DoS.

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.

A regression in the fix for bug 66512 in Apache Tomcat causes that if a response does not include any HTTP headers, no AJP SEND_HEADERS message will be sent. This leads to at least one AJP proxy (mod_proxy_ajp) using the response headers from the previous request, resulting in an information leak.

A vulnerability in Tomcat packages for SUSE systems is caused by incorrect default permissions, allowing a local attacker from the tomcat group to escalate privileges to root. The issue affects multiple versions of SUSE Linux Enterprise Server, SUSE Enterprise Storage, and SUSE OpenStack Cloud.

Vulnerability in Apache Tomcat when configured with the JMX Remote Lifecycle Listener. A local attacker without access to the Tomcat process or configuration files can manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.