Description
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache Tomcat
Default version status: unaffected
8.5.7 to ≤ 8.5.63affected9.0.0-M11 to ≤ 9.0.43affected10.0.0-M1 to ≤ 10.0.27unknown
References
- https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz ↗
- http://www.openwall.com/lists/oss-security/2024/01/19/2 ↗
- http://packetstormsecurity.com/files/176951/Apache-Tomcat-8.5.63-9.0.43-HTTP-Response-Smuggling.html ↗
- https://security.netapp.com/advisory/ntap-20240216-0005/ ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html ↗