What is GHSA-rp8h-vr48-4j8p?

GHSA-rp8h-vr48-4j8p is a security advisory published by GitHub Security Advisories with Medium severity. Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests

Which CVE IDs does GHSA-rp8h-vr48-4j8p cover?

GHSA-rp8h-vr48-4j8p covers the following CVE IDs: CVE-2011-3375. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-rp8h-vr48-4j8p?

GHSA-rp8h-vr48-4j8p affects 2 products, including: maven/org.apache.tomcat:tomcat:\u003e= 6.0.30, \u003c= 6.0.33; maven/org.apache.tomcat:tomcat:\u003e= 7.0, \u003c 7.0.22.

GHSA-rp8h-vr48-4j8pMedium

Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 19, 2024

🔗 CVE IDs covered (1)

CVE-2011-3375 →

📋 Description

Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.

🎯 Affected products2

maven/org.apache.tomcat:tomcat:>= 6.0.30, <= 6.0.33
maven/org.apache.tomcat:tomcat:>= 7.0, < 7.0.22

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2011-3375
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-7.html
http://www.debian.org/security/2012/dsa-2401
https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21
https://github.com/advisories/GHSA-rp8h-vr48-4j8p