CVE-2013-2071

Apache Tomcat 7.0.0-7.0.39 - Exposure of Sensitive Information via AsyncListener RuntimeException

Title source: llm

Description

java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.

References (14)

Core 14

Core References

Patch x_refsource_confirm

http://svn.apache.org/viewvc?view=revision&revision=1471372

Patch x_refsource_confirm

http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/AsyncContextImpl.java?r1=1471372&r2=1471371&pathrev=1471372

Exploit x_refsource_confirm

https://issues.apache.org/bugzilla/show_bug.cgi?id=54178

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105855.html

Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-7.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106342.html

Third Party Advisory mailing-list x_refsource_bugtraq

http://archives.neohapsis.com/archives/bugtraq/2013-05/0040.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1841-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/59798

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/64758

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2013-08/msg00013.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105886.html

Mailing List vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=139344248911289&w=2

Scores

EPSS 0.0650

EPSS Percentile 93.0%

Details

CWE

CWE-200

Status published

Products (29)

apache/tomcat 7.0.0 (2 CPE variants)

apache/tomcat 7.0.1

apache/tomcat 7.0.2 (2 CPE variants)

apache/tomcat 7.0.3

apache/tomcat 7.0.4 (2 CPE variants)

apache/tomcat 7.0.5

apache/tomcat 7.0.6

apache/tomcat 7.0.7

apache/tomcat 7.0.8

apache/tomcat 7.0.9

... and 19 more

Published Jun 01, 2013

Tracked Since Feb 18, 2026