Description
An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 8.5.7 to 8.5.9, 9.0.0.M11 to 9.0.0.M15 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 8.5.7, < 8.5.10 | 8.5.10 | GHSA-fjwp-r6fm-q6qw |
| Maven | org.apache.tomcat:tomcat | >= 9.0.0.M11, < 9.0.0.M16 | 9.0.0.M16 | GHSA-fjwp-r6fm-q6qw |
References
- https://security.netapp.com/advisory/ntap-20180614-0002/
- http://tomcat.apache.org/security-9.html
- 96895 vdb-entry
- http://svn.apache.org/viewvc?view=revision&revision=1774161
- http://tomcat.apache.org/security-8.html
- http://svn.apache.org/viewvc?view=revision&revision=1774166
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list