Sensitive Information Uncleared Before Release Affecting tomcat8-lib package, versions <0:8.5.81-1.91.amzn1


Severity

Recommended
0.0
high
0
10

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.22% (60th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN201803-TOMCAT8LIB-2975112
  • published5 Aug 2022
  • disclosed13 May 2022

Introduced: 13 May 2022

CVE-2022-25762  (opens in a new tab)
CWE-226  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2018.03 tomcat8-lib to version 0:8.5.81-1.91.amzn1 or higher.
This issue was patched in ALAS-2022-1627.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat8-lib package and not the tomcat8-lib package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2018.03 relevant fixed versions and status.

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

CVSS Scores

version 3.1