Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oNmM4LXJnODctZjNwY84AAZEC

Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users

The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."

Permalink: https://github.com/advisories/GHSA-h6c8-rg87-f3pc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNmM4LXJnODctZjNwY84AAZEC
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 4 months ago

Identifiers: GHSA-h6c8-rg87-f3pc, CVE-2011-1475
References:

• https://nvd.nist.gov/vuln/detail/CVE-2011-1475
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66676
• https://issues.apache.org/bugzilla/show_bug.cgi?id=50957
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12374
• http://seclists.org/fulldisclosure/2011/Apr/97
• http://svn.apache.org/viewvc?view=revision&revision=1086349
• http://svn.apache.org/viewvc?view=revision&revision=1086352
• http://tomcat.apache.org/security-7.html
• https://github.com/apache/tomcat/commit/d2e8f2ede7dea39f75f68384f331f38f094e4ed3
• https://github.com/apache/tomcat/commit/fd8a579e0e2379a84826b11700adf396e4ed2041
• https://web.archive.org/web/20120605200856/http://www.securityfocus.com/bid/47199
• https://web.archive.org/web/20170202012852/http://www.securityfocus.com/archive/1/517363
• https://web.archive.org/web/20170317142459/http://www.securitytracker.com/id?1025303
• https://github.com/advisories/GHSA-h6c8-rg87-f3pc

Repository: https://github.com/apache/tomcat
Blast Radius: 0.0

Affected Packages