CVE-2023-42795: Apache Tomcat information leak via incomplete object cleanup

CVE-2023-42795 · Severity: medium · CVSS 5.3 · Published 2023-10-10

Apache Tomcat, a widely used web server and application container, is affected by a flaw that fails to properly clear data between user requests. This could allow sensitive information from one user's session to leak into another user's session. Organizations should update to a patched version to prevent potential data exposure.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat:tomcat-util (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2023-42795 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-42795 being exploited in the wild.
How severe is CVE-2023-42795?
Medium severity, with a CVSS score of 5.3, published 10 October 2023.
Which products and versions are affected?
Apache Tomcat 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.80, 10.1.0-M1 to 10.1.13, 11.0.0-M1 to 11.0.0-M11; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.0-M12; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.0-M12; org.apache.tomcat:tomcat-util (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.0-M12; and 1 more.
Is there a fix for CVE-2023-42795?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.0-M12 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.0-M12 or later; org.apache.tomcat:tomcat-util (Maven): upgrade to 11.0.0-M12 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-42795 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-42795?
Check whether you run Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 11.0.0-M12 or later
    # set org.apache.tomcat:tomcat to 11.0.0-M12 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.0-M12 or later
    # set org.apache.tomcat:tomcat-catalina to 11.0.0-M12 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-util (Maven): upgrade to 11.0.0-M12 or later
    # set org.apache.tomcat:tomcat-util to 11.0.0-M12 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.1.14 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 10.1.14 in your pom.xml or build.gradle

Technical details

Apache Tomcat contains an incomplete cleanup vulnerability (CWE-459) during the recycling of internal objects. When an error occurs during the recycling process, Tomcat may skip certain cleanup steps, causing data from a previous request or response to persist and be accessible to a subsequent, unrelated request. This is a network-based attack that requires no authentication or user interaction. The vulnerability affects multiple major versions including 8.5.x, 9.0.x, 10.1.x, and 11.0.x. Patches have been released in versions 8.5.94, 9.0.81, 10.1.14, and 11.0.0-M12.

Affected products

  • Apache Tomcat 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.80, 10.1.0-M1 to 10.1.13, 11.0.0-M1 to 11.0.0-M11

Identifiers

  • CVE-2023-42795
  • GHSA-g8pj-r55q-5c2v

Timeline

  • 2023-10-10: disclosed
  • 2023-10-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.