CVE-2022-25762: Apache Tomcat WebSocket Message Handling Vulnerability
Summary
CVE-2022-25762: Response mix-up with WebSocket concurrent send and close. Affects tomcat across 2 version ranges.
>= 8.5.0, < 8.5.76
>= 9.0.0, < 9.0.21
Fixed in 8.5.76 or 9.0.21, depending on the release line you run. How to fix ↓
Also tracked for
- org.apache.tomcat:tomcat · Maven
- tomcat9 · Debian:11
The same CVE-2022-25762 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. This vulnerability affects Apache Tomcat versions 8.5.0 to 8.5.75 and 9.0.0.M1 to 9.0.20. The vulnerability arises when a web application sends a WebSocket message concurrently with the WebSocket connection closing. In such cases, the application may continue to use the socket after it has been closed, leading to potential errors and data leakage.
Vulnerability Detail
The vulnerability in Apache Tomcat's WebSocket message handling can result in a pooled object being placed in the pool twice. This can lead to subsequent connections using the same object concurrently, potentially causing data to be returned to the wrong user and other errors. The error handling triggered by this scenario can have serious consequences, including data leakage and unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.768.5.76 -
>= 9.0.0, < 9.0.219.0.21
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the WebSocket functionality in Apache Tomcat by modifying the server configuration. This can be achieved by commenting out or removing the WebSocket-related configuration entries in the server.xml file. However, this workaround will disable WebSocket functionality for all web applications hosted on the server.
Conclusion
In conclusion, the Apache Tomcat WebSocket message handling vulnerability can lead to data leakage and other errors. It is crucial to promptly update to the fixed versions of Apache Tomcat to mitigate the risk. Regularly updating Apache Tomcat and staying informed about security vulnerabilities is essential for maintaining a secure web application environment. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications.
The vulnerability affects Apache Tomcat versions 8.5.0 to 8.5.75 and 9.0.0.M1 to 9.0.20.
The vulnerability can result in data leakage, unauthorized access to sensitive information, and other errors.
To fix this vulnerability, it is recommended to upgrade to Apache Tomcat version 8.5.76 or later for versions 8.5.x, and version 9.0.21 or later for versions 9.0.x.
Yes, a temporary workaround is to disable the WebSocket functionality in Apache Tomcat by modifying the server configuration.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
