GHSA-rp8h-vr48-4j8p

Source

https://github.com/advisories/GHSA-rp8h-vr48-4j8p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rp8h-vr48-4j8p/GHSA-rp8h-vr48-4j8p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rp8h-vr48-4j8p

Aliases

CVE-2011-3375

Published

2022-05-17T05:33:28Z

Modified

2024-01-19T19:43:22.443020Z

Summary

Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests

Details

Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.

Database specific

{
    "nvd_published_at": "2012-01-19T04:01:00Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-19T19:22:15Z"
}

References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.30

Fixed

6.0.35

Database specific

{
    "last_known_affected_version_range": "<= 6.0.33"
}