Timing Attack Affecting org.apache.tomcat.embed:tomcat-embed-core package, versions [7.0.0,7.0.72) [8.0.0-RC1,8.0.37) [8.5.0,8.5.5) [9.0.0.M1,9.0.0.M10)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHETOMCATEMBED-30988
- published 28 Oct 2016
- disclosed 28 Oct 2016
- credit The Apache Tomcat Security Team
Introduced: 28 Oct 2016
CVE-2016-0762 Open this link in a new tabHow to fix?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 7.0.72, 8.0.37, 8.5.5, 9.0.0.M10 or higher.
Overview
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.
Affected versions of this package are vulnerable to Timing Attack. The setGlobalContext method in ResourceLinkFactory.java does not consider whether callers to this method are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.