org.apache.tomcat:tomcat-util@8.5.4 vulnerabilities

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Denial of Service (DoS) when an attacker sends a large number of request parts in a series of uploads or a single multipart upload.

NOTE: After upgrading to the fixed version, the setFileCountMax() must be explicitly set to avoid this vulnerability.

Upgrade org.apache.tomcat:tomcat-util to version 8.5.85, 9.0.71, 10.1.5, 11.0.0-M3 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release. When a web application sends a WebSocket message concurrently with the WebSocket connection closing, the application may continue to use the socket after it has been closed. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

Upgrade org.apache.tomcat:tomcat-util to version 8.5.76, 9.0.21 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Arbitrary File Upload. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).

Upgrade org.apache.tomcat:tomcat-util to version 9.0.31, 8.5.51, 7.0.100 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the UTF-8 decoder. When handling some special characters, the decoder may enter an infinite loop, thus denying service to other requests.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.90, 8.0.52, 8.5.32, 9.0.10 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Arbitrary Code Execution. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

This is due to an incomplete fix for CVE-2017-12615.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.82, 8.0.46, 8.5.22, 9.0.1 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Information Exposure. The refactoring of the Connector code for 8.5.x onwards introduced a regression in the error handling of the send file code for the NIO HTTP connector. An error during send file processing resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.74, 8.5.9, 8.0.40, 9.0.0M15 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Information Exposure. It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

Upgrade org.apache.tomcat:tomcat-util to version 8.0.37, 8.5.5, 9.0.0.M10 or higher.