Timing Attack Affecting org.apache.tomcat:tomcat-catalina package, versions [7.0.0,7.0.72) [8,8.0.37) [8.5.0,8.5.5) [9-alpha,9.0.0.M10)


0.0
medium

Snyk CVSS

    Attack Complexity High
    Confidentiality High

    Threat Intelligence

    EPSS 0.13% (48th percentile)
Expand this section
NVD
5.9 medium
Expand this section
Red Hat
3.7 low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHETOMCAT-30916
  • published 28 Oct 2016
  • disclosed 28 Oct 2016
  • credit The Apache Tomcat Security Team

How to fix?

Upgrade org.apache.tomcat:tomcat-catalina to version 7.0.72, 8.0.37, 8.5.5, 9.0.0.M10 or higher.

Overview

org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations.

Affected versions of this package are vulnerable to Timing Attack. The setGlobalContext method in ResourceLinkFactory.java does not consider whether callers to this method are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.