PT-2011-4413 · Apache · Apache Tomcat

Publicado 2011-12-05 · Atualizado 2022-05-17 · CVE-2011-3375

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.30 through 6.0.33 Apache Tomcat versions 7.x before 7.0.22

Description The issue arises from improper caching and recycling operations involving request objects, allowing remote attackers to obtain unintended read access to IP address and HTTP header information in certain circumstances by reading TCP data. This occurs because the internal request object and internal processor object are not recycled at the same time, leading to information leakage from one request to the next when errors trigger the re-population of the request object after it has been recycled.

Recommendations For Apache Tomcat versions 6.0.30 through 6.0.33, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 7.x before 7.0.22, update to version 7.0.22 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-3375

DSA-2401-1

GHSA-RP8H-VR48-4J8P

RHSA-2012:0682

Produtos afetados

Apache Tomcat

Referências · 10

• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3375 · Nota de Segurança
• http://tomcat.apache.org/security-7.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3375 · Nota
• https://osv.dev/vulnerability/GHSA-rp8h-vr48-4j8p · Aviso do Fabricante
• https://tomcat.apache.org/security-6 · Nota
• http://debian.org/security/2012/dsa-2401 · Aviso do Fabricante
• https://tomcat.apache.org/security-7 · Nota
• http://tomcat.apache.org/security-6.html · Aviso do Fabricante