GitHub Advisoryadvisory · Maven
GHSA-h6c8-rg87-f3pc Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
MEDIUM
Official page ↗
- Aliases
- CVE-2011-1475
- Ecosystem
- Maven
- Packages
- org.apache.tomcat:tomcat
- Severity
- Moderate
- Weaknesses
- CWE-20
- Reviewed
- 2024-01-17
Affected packages
• Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.12 → fixed in 7.0.12
Description
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
Related
Alias · CVE (1)
- CVE-2011-1475 The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-1475 advisory
- https://github.com/apache/tomcat/commit/d2e8f2ede7dea39f75f68384f331f38f094e4ed3 web
- https://github.com/apache/tomcat/commit/fd8a579e0e2379a84826b11700adf396e4ed2041 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66676 web
- https://github.com/apache/tomcat web
- https://issues.apache.org/bugzilla/show_bug.cgi?id=50957 web
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12374 web
- https://web.archive.org/web/20120605200856/http://www.securityfocus.com/bid/47199 web
- https://web.archive.org/web/20170202012852/http://www.securityfocus.com/archive/1/517363 web
- https://web.archive.org/web/20170317142459/http://www.securitytracker.com/id?1025303 web
- http://seclists.org/fulldisclosure/2011/Apr/97 web
- http://svn.apache.org/viewvc?view=revision&revision=1086349 web
- http://svn.apache.org/viewvc?view=revision&revision=1086352 web
- http://tomcat.apache.org/security-7.html web