{"id":"CVE-2013-2071","aliases":["DSA-2897-1","EUVD-2022-2217","GHSA-3p5r-7cw3-2m67","MGASA-2013-0191","RHSA-2013:1011","RHSA-2013:1012"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.","severity":{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06501,"percentile":0.93809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2013-06-01T10:00:00Z","modified":"2026-08-05T10:02:16Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["7.0.40"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:2","package":"tomcat","fixed_in":["7.0.41-3.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"tomcat","fixed_in":["7.0.41-4.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.40"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.28-4+deb7u1"}]}],"versions":["7.0.28-4"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.40"}]}],"versions":["7.0.35","7.0.37","7.0.39"]},{"source":"osv","ecosystem":"Mageia:2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.41-3.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.41-4.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-daemon-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-4.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-daemon-jsvc-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-1.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-pool-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.redhat_4.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-pool-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.redhat_4.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"dom4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-19.redhat_5.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"ecj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.2-6.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.27-4.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-4.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-jsvc-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-1.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-jsvc-eap6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-1.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-pool-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.redhat_4.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-pool-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.redhat_4.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"dom4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-19.redhat_5.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"ecj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.2-6.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.27-4.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.27-4.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1471372","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/AsyncContextImpl.java?r1=1471372\u0026r2=1471371\u0026pathrev=1471372","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=54178","tags":["x_refsource_CONFIRM","x_transferred","Exploit","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105855.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106342.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-05/0040.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1841-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/59798","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/bid/64758","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-08/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105886.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=139344248911289\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2071","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3p5r-7cw3-2m67"},{"url":"https://advisories.mageia.org/MGASA-2013-0191.html","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.40","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10200","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1011","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Web_Server/2/html-single/Installation_Guide/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=961779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=961783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=961803","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1011.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3499","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3544","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4558","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2067","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2067","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2067","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2071","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1012","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1012.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-2071","description":"java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.","status":"published","published":"2013-06-01T10:00:00Z","modified":"2024-08-06T15:27:40.654Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2022-2217","description":"java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.","status":"published","published":"2013-06-01T10:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-3p5r-7cw3-2m67","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.","status":"published","published":"2022-05-17T02:44:28Z","modified":"2023-01-27T05:02:35Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2013-2071","description":"java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.","status":"published","published":"2013-06-01T14:21:05.89Z","modified":"2026-06-16T23:52:41.717Z","cvss":[{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"DSA-2897-1","title":"tomcat7 - security update","status":"published","published":"2014-04-08T00:00:00Z","modified":"2026-03-09T01:18:45.204972Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"GHSA-3p5r-7cw3-2m67","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.","status":"published","published":"2022-05-17T02:44:28Z","modified":"2024-12-06T05:33:30.508604Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"MGASA-2013-0191","title":"Updated tomcat7 packages fix CVE-2013-2071","description":"java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x\nbefore 7.0.40 does not properly handle the throwing of a RuntimeException\nin an AsyncListener in an application, which allows context-dependent\nattackers to obtain sensitive request information intended for other\napplications in opportunistic circumstances via an application that records\nthe requests that it processes (CVE-2013-2071).\n","status":"published","published":"2013-07-01T19:08:10Z","modified":"2026-04-16T06:23:34.595503495Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2013:1011","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update","status":"published","published":"2024-09-15T20:50:45Z","modified":"2026-08-05T10:02:15Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1012","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update","status":"published","published":"2024-09-15T20:50:50Z","modified":"2026-08-05T10:02:16Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}