CVE-2022-25762

Published: 13 May 2022

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

Priority

Cvss 3 Severity Score

8.6

Score breakdown

Status

Package	Release	Status
tomcat8 Launchpad, Ubuntu, Debian	bionic	Needs triage
	upstream	Needs triage
	xenial	Needs triage
tomcat9 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Not vulnerable (9.0.31-1ubuntu0.2)
	impish	Not vulnerable
	jammy	Not vulnerable
	kinetic	Not vulnerable
	lunar	Not vulnerable
	mantic	Not vulnerable
	upstream	Released (9.0.22-1)

Severity score breakdown

Parameter	Value
Base score	8.6
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›