GHSA-c57p-3v2g-w9rg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-c57p-3v2g-w9rg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c57p-3v2g-w9rg/GHSA-c57p-3v2g-w9rg.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-c57p-3v2g-w9rg
- Aliases
-
- CVE-2011-2204
- Published
- 2022-05-14T01:17:03Z
- Modified
- 2024-02-21T21:32:35Z
- Summary
- Insertion of Sensitive Information into Log File in Apache Tomcat
- Details
-
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
This issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.
- Database specific
{ "nvd_published_at": "2011-06-29T17:55:00Z", "cwe_ids": [ "CWE-200", "CWE-532" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2022-07-13T17:26:44Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2011-2204
- https://github.com/apache/tomcat/commit/763a56b45999653ce648a18462b8a826809215b1
- https://github.com/apache/tomcat55/commit/8b81c8c869987e35deed04993ecfcf7be27ca298
- https://access.redhat.com/errata/RHSA-2011:1845
- https://bugzilla.redhat.com/show_bug.cgi?id=717013
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68238
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14931
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532
- https://web.archive.org/web/20110711083618/http://securitytracker.com/id?1025712
- http://marc.info/?l=bugtraq&m=132215163318824&w=2
- http://marc.info/?l=bugtraq&m=133469267822771&w=2
- http://marc.info/?l=bugtraq&m=136485229118404&w=2
- http://marc.info/?l=bugtraq&m=139344343412337&w=2
- http://support.apple.com/kb/HT5130
- http://tomcat.apache.org/security-5.html
- http://tomcat.apache.org/security-6.html
- http://tomcat.apache.org/security-7.html
- http://www.debian.org/security/2012/dsa-2401
Affected packages
Maven / org.apache.tomcat:tomcat
Package
- Name
- org.apache.tomcat:tomcat
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.tomcat/tomcat
Maven / org.apache.tomcat:tomcat
Package
- Name
- org.apache.tomcat:tomcat
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.tomcat/tomcat
Maven / org.apache.tomcat:tomcat
Package
- Name
- org.apache.tomcat:tomcat
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.tomcat/tomcat