CVE-2013-2071 — tomcat: Information disclosure in asynchronous context when using AsyncListeners that threw RuntimeExceptions

Back Back to CVE browser

LOW

tomcat: Information disclosure in asynchronous context when using AsyncListeners that threw RuntimeExceptions

Published Jun 1, 2013

2.6

LOW

CVSS 2.0

EPSS 6.50%

Description

java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.

Affected products

Red Hat JBoss Enterprise Web Server 2 for RHEL 5

apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

apache-commons-pool-eap6-0:1.6-6.redhat_4.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

dom4j-0:1.6.1-19.redhat_5.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

ecj3-1:3.7.2-6.redhat_1.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

httpd-0:2.2.22-23.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

mod_cluster-0:1.2.4-1.Final_redhat_1.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

mod_cluster-native-0:1.2.4-1.Final.redhat_1.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

mod_jk-0:1.2.37-2.redhat_1.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

tomcat-native-0:1.1.27-4.redhat_1.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

tomcat6-0:6.0.37-8_patch_01.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5

tomcat7-0:7.0.40-9_patch_01.ep6.el5

Fixed · RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

apache-commons-pool-eap6-0:1.6-6.redhat_4.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

dom4j-0:1.6.1-19.redhat_5.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

ecj3-1:3.7.2-6.redhat_1.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

httpd-0:2.2.22-23.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

mod_cluster-0:1.2.4-1.Final_redhat_1.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

mod_cluster-native-0:1.2.4-1.Final.redhat_1.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

mod_jk-0:1.2.37-2.redhat_1.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

tomcat-native-0:1.1.27-4.redhat_1.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

tomcat6-0:6.0.37-10_patch_01.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6

tomcat7-0:7.0.40-5_patch_01.ep6.el6

Fixed · RHSA-2013:1012
Red Hat JBoss Web Server 2.0

n/a

Fixed · RHSA-2013:1013
Red Hat Enterprise Linux 5

tomcat5

Not affected
Red Hat Enterprise Linux 6

tomcat6

Not affected
Red Hat JBoss Enterprise Web Server 1

tomcat5

Not affected
Red Hat JBoss Enterprise Web Server 1

tomcat6

Not affected

Product	Package	State	Advisory
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	apache-commons-pool-eap6-0:1.6-6.redhat_4.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	dom4j-0:1.6.1-19.redhat_5.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	ecj3-1:3.7.2-6.redhat_1.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	httpd-0:2.2.22-23.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	mod_cluster-0:1.2.4-1.Final_redhat_1.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	mod_cluster-native-0:1.2.4-1.Final.redhat_1.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	mod_jk-0:1.2.37-2.redhat_1.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	tomcat-native-0:1.1.27-4.redhat_1.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	tomcat6-0:6.0.37-8_patch_01.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 5	tomcat7-0:7.0.40-9_patch_01.ep6.el5	Fixed	RHSA-2013:1011
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	apache-commons-pool-eap6-0:1.6-6.redhat_4.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	dom4j-0:1.6.1-19.redhat_5.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	ecj3-1:3.7.2-6.redhat_1.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	httpd-0:2.2.22-23.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	mod_cluster-0:1.2.4-1.Final_redhat_1.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	mod_cluster-native-0:1.2.4-1.Final.redhat_1.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	mod_jk-0:1.2.37-2.redhat_1.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	tomcat-native-0:1.1.27-4.redhat_1.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	tomcat6-0:6.0.37-10_patch_01.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Enterprise Web Server 2 for RHEL 6	tomcat7-0:7.0.40-5_patch_01.ep6.el6	Fixed	RHSA-2013:1012
Red Hat JBoss Web Server 2.0	n/a	Fixed	RHSA-2013:1013
Red Hat Enterprise Linux 5	tomcat5	Not affected	n/a
Red Hat Enterprise Linux 6	tomcat6	Not affected	n/a
Red Hat JBoss Enterprise Web Server 1	tomcat5	Not affected	n/a
Red Hat JBoss Enterprise Web Server 1	tomcat6	Not affected	n/a

Remediation

Red Hat statement

This flaw only affects tomcat 7. Tomcat 5 and 6 are not affected. The jbossweb servlet container is also not affected.

Metrics

6.50% 0.06501

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.06501

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	6.50% (0.06501)	93.56th	v5 (v2026.06.15)
Jun 15, 2026	6.50% (0.06501)	92.87th	v5 (v2026.06.15)
Mar 2, 2026	8.45% (0.08446)	92.22th	v4 (v2025.03.14)
Mar 30, 2025	6.87% (0.06868)	90.47th	v4 (v2025.03.14)
Mar 29, 2025	8.65% (0.08647)	87.19th	v4 (v2025.03.14)
Mar 17, 2025	6.87% (0.06868)	90.68th	v4 (v2025.03.14)
Dec 12, 2024	0.20% (0.00204)	59.34th	v3 (v2023.03.01)
Feb 17, 2024	0.20% (0.00204)	57.52th	v3 (v2023.03.01)
Jul 19, 2023	0.22% (0.00219)	58.91th	v3 (v2023.03.01)
May 31, 2023	0.32% (0.00317)	66.02th	v3 (v2023.03.01)
Mar 7, 2023	0.35% (0.00352)	67.48th	v3 (v2023.03.01)
Mar 6, 2023	5.24% (0.05242)	89.75th	v2 (v2022.01.01)
Apr 1, 2022	5.24% (0.05242)	88.72th	v2 (v2022.01.01)
Feb 4, 2022	5.24% (0.05242)	75.28th	v2 (v2022.01.01)

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (19)

http://archives.neohapsis.com/archives/bugtraq/2013-05/0040.html
mailing-listx_refsource_BUGTRAQ
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105855.html
vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105886.html
vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106342.html
vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-updates/2013-08/msg00013.html
vendor-advisoryx_refsource_SUSE
http://marc.info/?l=bugtraq&m=139344248911289&w=2
vendor-advisoryx_refsource_HP
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/AsyncContextImpl.java?r1=1471372&r2=1471371&pathrev=1471372
x_refsource_CONFIRMPatch
http://svn.apache.org/viewvc?view=revision&revision=1471372
x_refsource_CONFIRMPatch
http://tomcat.apache.org/security-7.html
x_refsource_CONFIRMVendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
x_refsource_CONFIRM
http://www.securityfocus.com/bid/59798
vdb-entryx_refsource_BID
http://www.securityfocus.com/bid/64758
vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-1841-1
vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/security/cve/CVE-2013-2071
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=961803
Issue Tracking
https://github.com/advisories/GHSA-3p5r-7cw3-2m67
Advisory
https://issues.apache.org/bugzilla/show_bug.cgi?id=54178
x_refsource_CONFIRMExploit
https://nvd.nist.gov/vuln/detail/CVE-2013-2071
https://www.cve.org/CVERecord?id=CVE-2013-2071

Link	Providers	Tags
http://archives.neohapsis.com/archives/bugtraq/2013-05/0040.html		mailing-listx_refsource_BUGTRAQ
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105855.html		vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105886.html		vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106342.html		vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-updates/2013-08/msg00013.html		vendor-advisoryx_refsource_SUSE
http://marc.info/?l=bugtraq&m=139344248911289&w=2		vendor-advisoryx_refsource_HP
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/AsyncContextImpl.java?r1=1471372&r2=1471371&pathrev=1471372		x_refsource_CONFIRMPatch
http://svn.apache.org/viewvc?view=revision&revision=1471372		x_refsource_CONFIRMPatch
http://tomcat.apache.org/security-7.html		x_refsource_CONFIRMVendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html		x_refsource_CONFIRM
http://www.securityfocus.com/bid/59798		vdb-entryx_refsource_BID
http://www.securityfocus.com/bid/64758		vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-1841-1		vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/security/cve/CVE-2013-2071		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=961803		Issue Tracking
https://github.com/advisories/GHSA-3p5r-7cw3-2m67		Advisory
https://issues.apache.org/bugzilla/show_bug.cgi?id=54178		x_refsource_CONFIRMExploit
https://nvd.nist.gov/vuln/detail/CVE-2013-2071
https://www.cve.org/CVERecord?id=CVE-2013-2071