Vulnerability in Apache Tomcat
CVE-2018-8037
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
Vulnerability class: Race Condition
EPSS: 0.121 (95.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Tomcat — versions 9.0.0
- Apache Software Foundation Tomcat — versions 9.0.0.M9 to 9.0.9, 8.5.5 to 8.5.31
- Debian Debian_linux — versions 9.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (Vendor Advisory, mailing-list, x_refsource_MLIST, Mailing List)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@apache.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- security@apache.org (x_refsource_CONFIRM, Third Party Advisory)
- security@apache.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security@apache.org (Vendor Advisory, mailing-list, x_refsource_MLIST, Mailing List)
- security@apache.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security@apache.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2018-8037?
- CVE-2018-8037 is a medium-severity vulnerability in Apache Tomcat, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.9/10. Published 2018-08-02.
- How severe is CVE-2018-8037?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2018-8037 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.