Apache Tomcat contains an observable timing discrepancy vulnerability in the comparison of the AJP secret. This affects versions from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.117, 10.1.0-M1 through 10.1.54, and 11.0.0-M1 through 11.0.21. The vulnerability allows an attacker to observe timing differences during secret comparison, which could potentially leak information about the secret. The issue is fixed in versions 11.0.22, 10.1.55, and 9.0.118. Numerous specific affected package versions are listed, including many Ubuntu package versions. The vulnerability has a CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and low confidentiality impact without integrity or availability impact.

The vulnerability allows an attacker to gain limited information about the AJP secret through timing discrepancies during secret comparison. This could potentially aid in further attacks relying on knowledge of the secret. The impact is limited to confidentiality with no direct integrity or availability effects. No known exploits in the wild have been reported.

A fix is available. Users are recommended to upgrade Apache Tomcat to versions 11.0.22, 10.1.55, or 9.0.118 or later, which address this timing discrepancy vulnerability. Applying these updates will remediate the issue.