[SECURITY] CVE-2011-1475 Apache Tomcat information disclosure

Type securityvulns
Reporter Securityvulns
Modified 2011-04-13T00:00:00


CVE-2011-1475 Apache Tomcat information disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: - Tomcat 7.0.0 to 7.0.11 - Earlier versions are not affected

Description: Changes introduced to the HTTP BIO connector to support Servlet 3.0 asynchronous requests did not fully account for HTTP pipelining. As a result, when using HTTP pipelining a range of unexpected behaviours occurred including the mixing up of responses between requests. While the mix-up in responses was only observed between requests from the same user, a mix-up of responses for requests from different users may also be possible.

Mitigation: Users of affected versions should apply one of the following mitigations: - Upgrade to a Tomcat 7.0.12 or later - Switch to the NIO or APR/native HTTP connectors that do not exhibit this issue

Credit: This issue was identified by Brad Piles and reported via the public ASF Bugzilla issue tracking system. The Apache Tomcat security team requests that security vulnerability reports are made privately to security@tomcat.apache.org in the first instance.

References: http://tomcat.apache.org/security.html http://tomcat.apache.org/security-7.html