Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-34981

Apache Tomcat: AJP response header mix-up

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Tomcat

Default version status: unaffected

  • 11.0.0-M5affected
  • 10.1.8affected
  • 9.0.74affected
  • 8.5.88affected

References