Description
Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 5.5.11, <= 5.5.25 | — | GHSA-qrj4-rmqg-4hcp |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, <= 6.0.15 | — | GHSA-qrj4-rmqg-4hcp |
References
- 3637 third-party-advisory
- 30676 third-party-advisory
- 28915 third-party-advisory
- 37460 third-party-advisory
- 31681 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 28878 third-party-advisory
- 20080208 [SECURITY] CVE-2007-6286: Tomcat duplicate request processing vulnerability mailing-list
- ADV-2008-0488 vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- SUSE-SR:2009:004 vendor-advisory
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- 32222 third-party-advisory
- FEDORA-2008-1467 vendor-advisory
- GLSA-200804-10 vendor-advisory
- FEDORA-2008-1603 vendor-advisory
- ADV-2008-1856 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- http://tomcat.apache.org/security-5.html
- ADV-2008-2780 vdb-entry
- MDVSA-2009:136 vendor-advisory
- HPSBST02955 vendor-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- 29711 third-party-advisory
- ADV-2009-3316 vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list