GHSA-qrj4-rmqg-4hcp
Apache Tomcat Does Not Properly Handle Empty Requests
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2007-6286
Description
Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 5.5.11, last affected 5.5.25 |
| Maven · org.apache.tomcat:tomcat | introduced 6.0.0, last affected 6.0.15 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2007-6286 ADVISORY
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E WEB
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html WEB
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html WEB
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html WEB
- http://marc.info/?l=bugtraq&m=139344343412337&w=2 WEB
- http://support.apple.com/kb/HT3216 WEB
- http://tomcat.apache.org/security-5.html WEB
- http://tomcat.apache.org/security-6.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |