Bug 782624 (CVE-2011-3375) - CVE-2011-3375 tomcat: information disclosure due to improper response and request object recycling
Summary: CVE-2011-3375 tomcat: information disclosure due to improper response and req...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-3375
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 783721 783722 783723 783724
Blocks: 782672
TreeView+ depends on / blocked
 
Reported: 2012-01-17 23:31 UTC by Vincent Danen
Modified: 2019-09-29 12:49 UTC (History)
7 users (show)

Fixed In Version: tomcat6 6.0.35
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-08-08 06:08:41 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0681 0 normal SHIPPED_LIVE Moderate: tomcat6 security and bug fix update 2012-05-21 20:38:23 UTC
Red Hat Product Errata RHSA-2012:0682 0 normal SHIPPED_LIVE Moderate: tomcat6 security and bug fix update 2012-05-21 20:48:57 UTC

Description Vincent Danen 2012-01-17 23:31:56 UTC
From the upstream advisory [1]:

For performance reasons, information parsed from a request is often
cached in two places: the internal request object and the internal
processor object. These objects are not recycled at exactly the same time.
When certain errors occur that needed to be added to the access log, the
access logging process triggers the re-population of the request object
after it has been recycled. However, the request object was not recycled
before being used for the next request. That lead to information leakage
(e.g. remote IP address, HTTP headers) from the previous request to the
next request.

The issue was resolved be ensuring that the request and response objects
were recycled after being re-populated to generate the necessary access
log entries.

Upstream has released 7.0.22 and 6.0.35 to correct this flaw.  Earlier versions of Tomcat (5.0.x and earlier) are not affected.

This was fixed in Tomcat 6.0.x via r1185995 [2].  More information is in the upstream bug [3].

[1] http://seclists.org/fulldisclosure/2012/Jan/236
[2] http://svn.apache.org/viewvc?view=revision&revision=1185998
[3] https://issues.apache.org/bugzilla/show_bug.cgi?id=51872

Comment 2 David Jorm 2012-01-20 05:26:57 UTC
RHEL 6/tomcat6 is not affected. It is 6.0.24, while this flaw only affects 6.0.30 to 6.0.33.

Comment 3 David Jorm 2012-01-21 12:12:49 UTC
JBoss Web is not affected by this flaw.

Comment 5 David Jorm 2012-01-22 02:18:42 UTC
Created tomcat6 tracking bugs for this issue

Affects: fedora-all [bug 783721]

Comment 6 Coty Sutherland 2012-01-30 18:57:19 UTC
It appears that this does affect EWS 1.0.2 (tomcat 6.0.32). Are we making any kind of progress on this?

Comment 7 David Jorm 2012-01-31 02:31:10 UTC
(In reply to comment #6)
> It appears that this does affect EWS 1.0.2 (tomcat 6.0.32). Are we making any
> kind of progress on this?

EWS is affected by this flaw. We plan to ship a patch as part of an async erratum to EWS 1.0.2. The erratum is currently in the development and QE process. We do not have a firm target date for the release.

Comment 10 Coty Sutherland 2012-05-01 16:43:47 UTC
Are we making any kind of progress on this for EWS 1.0.2 (tomcat 6.0.32)?

Comment 11 David Jorm 2012-05-01 23:58:09 UTC
(In reply to comment #10)
> Are we making any kind of progress on this for EWS 1.0.2 (tomcat 6.0.32)?

An erratum for EWS 1.0.2 is in progress. It is currently awaiting QE.

Comment 12 errata-xmlrpc 2012-05-21 16:42:27 UTC
This issue has been addressed in following products:

  JBEWS 1.0

Via RHSA-2012:0681 https://rhn.redhat.com/errata/RHSA-2012-0681.html

Comment 13 errata-xmlrpc 2012-05-21 16:52:57 UTC
This issue has been addressed in following products:

  JBEWS 1.0 for RHEL 5
  JBEWS 1.0 for RHEL 6

Via RHSA-2012:0682 https://rhn.redhat.com/errata/RHSA-2012-0682.html


Note You need to log in before you can comment on or make changes to this bug.