GitHub Advisoryadvisory · Maven

GHSA-rp8h-vr48-4j8p Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests

MEDIUM Published 2022-05-17 Modified 2024-01-19 Official page ↗
Aliases
CVE-2011-3375
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-01-19

Affected packages

• Maven org.apache.tomcat:tomcat: >= 6.0.30, < 6.0.35 → fixed in 6.0.35 • Maven org.apache.tomcat:tomcat: >= 7.0, < 7.0.22 → fixed in 7.0.22

Description

Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.

Related

Alias · CVE (1)

  • CVE-2011-3375 Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References