~ / search / GHSA-j39c-c8hj-x4j3

GHSA-j39c-c8hj-x4j3

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Source: GitHub Advisory Database (reviewed) High CVE-2021-25122

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.0.0-M1, < 10.0.2 10.0.2
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M1, < 9.0.43 9.0.43
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, < 8.5.63 8.5.63
Maven org.apache.tomcat:tomcat-coyote >= 10.0.0-M1, < 10.0.2 10.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

References

External links from the advisory. They lead to third-party sites.