GitHub Advisoryadvisory · Maven

GHSA-mppv-79ch-vw6q Apache Tomcat vulnerable to information leak

HIGH Published 2023-06-21 Modified 2024-04-24 Official page ↗
Aliases
CVE-2023-34981
Ecosystem
Maven
Packages
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-732
Reviewed
2023-06-21

Affected packages

• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 11.0.0-M5, < 11.0.0-M6 → fixed in 11.0.0-M6 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.8, < 10.1.9 → fixed in 10.1.9 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.74, < 9.0.75 → fixed in 9.0.75 • Maven org.apache.tomcat:tomcat-coyote: >= 8.5.88, < 8.5.89 → fixed in 8.5.89

Description

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS message would be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Related

Alias · CVE (1)

  • CVE-2023-34981 A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References