PT-2011-4413 · Apache · Apache Tomcat

Published 2011-12-05 · Updated 2022-05-17 · CVE-2011-3375

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.30 through 6.0.33 Apache Tomcat versions 7.x before 7.0.22

Description The issue arises from improper caching and recycling operations involving request objects, allowing remote attackers to obtain unintended read access to IP address and HTTP header information in certain circumstances by reading TCP data. This occurs because the internal request object and internal processor object are not recycled at the same time, leading to information leakage from one request to the next when errors trigger the re-population of the request object after it has been recycled.

Recommendations For Apache Tomcat versions 6.0.30 through 6.0.33, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 7.x before 7.0.22, update to version 7.0.22 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-3375

DSA-2401-1

GHSA-RP8H-VR48-4J8P

RHSA-2012:0682

Affected Products

Apache Tomcat

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2011-3375 · Security Note
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rp8h-vr48-4j8p · Vendor Advisory
• http://debian.org/security/2012/dsa-2401 · Vendor Advisory
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• https://github.com/apache/tomcat · Note
• https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3375 · Note
• https://tomcat.apache.org/security-6 · Note
• https://tomcat.apache.org/security-7 · Note