Apache Tomcat 8.5.x < 8.5.32 Multiple Vulnerabilities

Severity

Theme

Apache Tomcat 8.5.x < 8.5.32 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 700695

Synopsis

The remote Apache Tomcat server is affected multiple security vulnerabilities.

Description

The version of Apache Tomcat installed on the remote host is version 8.5.x prior to 8.5.32. It is, therefore, affected by multiple vulnerabilities :

- The defaults settings for the CORS filter are insecure and enable supportsCredentials for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. (CVE-2018-8014)
- The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. (CVE-2018-8034)
- If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. (CVE-2018-8037)

Solution

Upgrade to Apache Tomcat version 8.5.32 or later.

Plugin Details

Severity: High

ID: 700695

Family: Web Servers

Published: 5/13/2019

Updated: 5/13/2019

Nessus ID: 111068

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Patch Publication Date: 2/13/2018

Vulnerability Publication Date: 2/12/2018

Reference Information

CVE: CVE-2018-8014, CVE-2018-8034, CVE-2018-8037

BID: 104203