Bug 5803 - [Anolis OS 8] Bugfix for CVE-2022-25762
Summary: [Anolis OS 8] Bugfix for CVE-2022-25762
Status: NEW
Alias: None
Product: Anolis OS 8
Classification: Anolis OS
Component: BaseOS Packages (show other bugs) BaseOS Packages
Version: 8.6
Hardware: All Linux
: P4-Low S4-trivial
Target Milestone: ---
Assignee: Jacob
QA Contact: shuming
URL:
Whiteboard:
Keywords: CVE
Depends on:
Blocks:
 
Reported: 2023-07-08 21:58 UTC by 小龙
Modified: 2023-07-08 21:58 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description 小龙 admin 2023-07-08 21:58:04 UTC 
Description:
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

Broken commit info:

Bugfix commit info:
https://github.com/apache/tomcat/commit/65fb1ee548111021edde247f3b3c409ec95a5183 (9.0.21)
https://github.com/apache/tomcat/commit/01f2cf25b270a84d0daeefc4f215aa2f56e1df99 (8.5.76)
https://github.com/apache/tomcat/commit/65fb1ee548111021edde247f3b3c409ec95a5183
https://github.com/apache/tomcat/commit/01f2cf25b270a84d0daeefc4f215aa2f56e1df99
https://github.com/apache/tomcat/commit/e2d5a040b962a904db5264b3cb3282c6b05f823c (9.0.21)
https://github.com/apache/tomcat/commit/e2d5a040b962a904db5264b3cb3282c6b05f823c
https://github.com/apache/tomcat/commit/7046644bf361b89afc246b6643e24ce2ae60cacc
https://github.com/apache/tomcat/commit/339b40bc07bdba9ded565929b9a3448c5a78f015 (9.0.21)
https://github.com/apache/tomcat/commit/339b40bc07bdba9ded565929b9a3448c5a78f015
https://github.com/apache/tomcat/commit/7046644bf361b89afc246b6643e24ce2ae60cacc (9.0.21)