Description

Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.

Remediation

References

http://tomcat.apache.org/security-6.html

http://tomcat.apache.org/security-7.html

http://www.debian.org/security/2012/dsa-2401

Related Vulnerabilities

CVE-2023-26476 Vulnerability in maven package org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki

CVE-2019-1003071 Vulnerability in maven package hudson.plugins.octopusdeploy:octopusdeploy

CVE-2023-32070 Vulnerability in maven package org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml

CVE-2014-7192 Vulnerability in npm package syntax-error

CVE-2022-3916 Vulnerability in maven package org.keycloak:keycloak-services

Severity

Critical

Classification

CWE-200

Tags

Vendor Advisory