Timing Attack Affecting org.apache.tomcat.embed:tomcat-embed-core package, versions [7.0.0,7.0.72) [8.0.0-RC1,8.0.37) [8.5.0,8.5.5) [9.0.0.M1,9.0.0.M10)

  • Attack Complexity


  • Confidentiality


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    28 Oct 2016

  • disclosed

    28 Oct 2016

  • credit

    The Apache Tomcat Security Team

How to fix?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 7.0.72, 8.0.37, 8.5.5, 9.0.0.M10 or higher.


org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Timing Attack. The setGlobalContext method in ResourceLinkFactory.java does not consider whether callers to this method are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.