Description: Fixes CVE-2015-5346: Session fixation vulnerability in Apache Tomcat
 when different session settings are used for deployments of multiple versions
 of the same web application, might allow remote attackers to hijack web sessions
 by leveraging use of a requestedSessionSSL field for an unintended request,
 related to CoyoteAdapter.java and Request.java.
Author: Markus Koschany <apo@debian.org>
Origin: backport, https://svn.apache.org/r1713185
                  https://svn.apache.org/r1723506
--- a/java/org/apache/catalina/connector/CoyoteAdapter.java
+++ b/java/org/apache/catalina/connector/CoyoteAdapter.java
@@ -941,9 +941,11 @@
                                 // Reset mapping
                                 request.getMappingData().recycle();
                                 mapRequired = true;
-                                // Recycle cookies in case correct context is
-                                // configured with different settings
-                                req.getCookies().recycle();
+                                // Recycle cookies and session info in case the
+                                // correct context is configured with different
+                                // setting
+                                request.recycleSessionInfo();
+                                request.recycleCookieInfo(true);
                             }
                             break;
                         }
--- a/java/org/apache/catalina/connector/Request.java
+++ b/java/org/apache/catalina/connector/Request.java
@@ -287,6 +287,11 @@
      */
     protected boolean cookiesParsed = false;
 
+    /**
+     * Cookie parsed flag. Indicates that the ServerCookies have been converted
+     * into user facing Cookie objects.
+     */
+    protected boolean cookiesConverted = false;
 
     /**
      * Secure flag.
@@ -461,7 +466,6 @@
             parts = null;
         }
         partsParseException = null;
-        cookiesParsed = false;
         locales.clear();
         localesParsed = false;
         secure = false;
@@ -475,20 +479,9 @@
         attributes.clear();
         sslAttributesParsed = false;
         notes.clear();
-        cookies = null;
 
-        if (session != null) {
-            try {
-                session.endAccess();
-            } catch (Throwable t) {
-                ExceptionUtils.handleThrowable(t);
-                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
-            }
-        }
-        session = null;
-        requestedSessionCookie = false;
-        requestedSessionId = null;
-        requestedSessionURL = false;
+        recycleSessionInfo();
+        recycleCookieInfo(false);
 
         if (Globals.IS_SECURITY_ENABLED || Connector.RECYCLE_FACADES) {
             parameterMap = new ParameterMap<>();
@@ -531,6 +524,31 @@
     }
 
 
+    protected void recycleSessionInfo() {
+        if (session != null) {
+            try {
+                session.endAccess();
+            } catch (Throwable t) {
+                ExceptionUtils.handleThrowable(t);
+                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
+            }
+        }
+        session = null;
+        requestedSessionCookie = false;
+        requestedSessionId = null;
+        requestedSessionURL = false;
+        requestedSessionSSL = false;
+    }
+
+    protected void recycleCookieInfo(boolean recycleCoyote) {
+        cookiesParsed = false;
+        cookiesConverted = false;
+        cookies = null;
+        if (recycleCoyote) {
+            getCoyoteRequest().getCookies().recycle();
+        }
+    }
+
     /**
      * Clear cached encoders (to save memory for Comet requests).
      */
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -168,6 +168,10 @@
         <bug>57011</bug>: Ensure that the request and response are correctly
         recycled when processing errors during async processing. (markt)
       </fix>
+      <fix>
+          <bug>58809</bug>: Correctly recycle cookies when mapping requests for
+               parallel deployment. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">
@@ -333,6 +337,10 @@
         page that has the <code>isErrorPage</code> page directive set to
         <code>true</code>. (markt)
       </fix>
+      <fix>
+        Handle the unlikely case where different versions of a web application
+        are deployed with different session settings. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="WebSocket">
