|
|
|
|
| |
Credit:
The information has been provided by Brad Piles.
The original article can be found at: http://seclists.org/bugtraq/2011/Apr/53
|
| |
Vulnerable Systems:
* Apache Tomcat 7.0.0 to Tomcat 7.0.11
Immune Systems:
* Apache Tomcat 7.0.12 or later
* Apache Tomcat earlier than 7.0.0
Changes introduced to the HTTP BIO connector to support Servlet 3.0 asynchronous requests did not fully account for HTTP pipelining. As a result, when using HTTP pipelining a range of unexpected behaviours occurred including the mixing up of responses between requests. While the mix-up in responses was only observed between requests from the same user, a mix-up of responses for requests from different users may also be possible.
Workaround:
Switch to the NIO or APR/native HTTP connectors that do not exhibit this issue.
CVE Information:
CVE-2011-1475
Disclosure Timeline:
Date release: 06 Apr 2011
|
|
|
|
|
