org.apache.tomcat:tomcat-util@9.0.0.M13 vulnerabilities

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Denial of Service (DoS) when an attacker sends a large number of request parts in a series of uploads or a single multipart upload.

NOTE: After upgrading to the fixed version, the setFileCountMax() must be explicitly set to avoid this vulnerability.

Upgrade org.apache.tomcat:tomcat-util to version 8.5.85, 9.0.71, 10.1.5, 11.0.0-M3 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release. When a web application sends a WebSocket message concurrently with the WebSocket connection closing, the application may continue to use the socket after it has been closed. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

Upgrade org.apache.tomcat:tomcat-util to version 8.5.76, 9.0.21 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Arbitrary Code Execution. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

This is due to an incomplete fix for CVE-2017-12615.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.82, 8.0.46, 8.5.22, 9.0.1 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Denial of Service (DoS). It allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.70, 8.0.36, 8.5.3, 9.0.0.M7 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Information Exposure. The refactoring of the Connector code for 8.5.x onwards introduced a regression in the error handling of the send file code for the NIO HTTP connector. An error during send file processing resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.74, 8.5.9, 8.0.40, 9.0.0M15 or higher.

org.apache.tomcat:tomcat-util The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

org.apache.tomcat:tomcat-util The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.