GHSA-qrj4-rmqg-4hcp

Dashboard / Vulnerabilities / GHSA-qrj4-rmqg-4hcp

GHSA-qrj4-rmqg-4hcp

Published: 1 May 2022Last Modified: 8 Nov 2023

Aliases:

CVE-2007-6286

Summary: Apache Tomcat Does Not Properly Handle Empty Requests

Details: Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.

References: https://nvd.nist.gov/vuln/detail/CVE-2007-6286, https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E, https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E, https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E, https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html, https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html, http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html, http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html, http://marc.info/?l=bugtraq&m=139344343412337&w=2, http://support.apple.com/kb/HT3216, http://tomcat.apache.org/security-5.html, http://tomcat.apache.org/security-6.html

Affected packages

Package

Name: org.apache.tomcat:tomcat

Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 5.5.11

Fixed -None

Affected versions

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High