Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
High severity
GitHub Reviewed
Published
Jun 16, 2021
to the GitHub Advisory Database
•
Updated Feb 3, 2023
Package
Affected versions
>= 10.0.0, < 10.0.2
>= 9.0.0, < 9.0.43
>= 8.5.0, < 8.5.63
Patched versions
10.0.2
9.0.43
8.5.63
Description
Published by the National Vulnerability Database
Mar 1, 2021
Reviewed
Mar 24, 2021
Published to the GitHub Advisory Database
Jun 16, 2021
Last updated
Feb 3, 2023
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
References