GitHub Advisoryadvisory · Maven

GHSA-qrj4-rmqg-4hcp Apache Tomcat Does Not Properly Handle Empty Requests

MEDIUM Published 2022-05-01 Modified 2023-09-22 Official page ↗
Aliases
CVE-2007-6286
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-09-22

Affected packages

• Maven org.apache.tomcat:tomcat: >= 5.5.11, <= 5.5.25 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 6.0.0, <= 6.0.15 (no fix yet)

Description

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

Related

Alias · CVE (1)

  • CVE-2007-6286 Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References