{"id":"CVE-2011-3375","published":"2012-01-19T02:00:00Z","modified":"2024-08-06T23:29:56Z","title":"Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0633,"percentile":0.93625,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.debian.org/security/2012/dsa-2401","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.7,"factors":[{"name":"EPSS percentile","points":18.73}]},"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=6.0.30, <6.0.35",">=7.0, <7.0.22"],"patched":["6.0.35","7.0.22"],"from":["GHSA-rp8h-vr48-4j8p"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5209","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-org-apache-tomcat-tomcat-cve-2005-2090","parents":[{"from":"CVE-2011-3190","to":"CVE-2011-3375","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.21","toFixed":"7.0.22","daysApart":141},{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/ajp/AbstractAjpProcessor.java","java/org/apache/coyote/ajp/AjpAprProcessor.java","java/org/apache/coyote/ajp/AjpNioProcessor.java","java/org/apache/coyote/ajp/AjpProcessor.java"],"commits":["https://github.com/apache/tomcat/commit/a2538ce78f83b7376c48d12d8247600079d789b1","https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21"],"basis":"shared function","functions":["process"]}]},{"from":"CVE-2008-2938","to":"CVE-2011-3375","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/connector/CoyoteAdapter.java"],"commits":["https://github.com/apache/tomcat/commit/c55ad56ed72ee1dbfe790bc5492d4df74e3e754f","https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21"],"basis":"rarely changed file"}]},{"from":"CVE-2010-2227","to":"CVE-2011-3375","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http11/AbstractHttp11Processor.java"],"commits":["https://github.com/apache/tomcat/commit/40e5880dfc51517334acda5f12beacdec52ca283","https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2011-3375","to":"CVE-2013-4286","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/ajp/AbstractAjpProcessor.java","java/org/apache/coyote/http11/AbstractHttp11Processor.java"],"commits":["https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21","https://github.com/apache/tomcat/commit/41b90b6ebc3e7f898a5a87d197ddf63790d33315","https://github.com/apache/tomcat/commit/7c040003f1387795356605566be7870cf70e05dc"],"basis":"shared function","functions":["prepareRequest"]}]}],"packageHistory":[{"cve":"CVE-2011-2204","published":"2011-06-29","fixed":"7.0.19","kev":false},{"cve":"CVE-2011-2526","published":"2011-07-14","fixed":"7.0.19","kev":false},{"cve":"CVE-2011-3190","published":"2011-08-31","fixed":"7.0.21","kev":false},{"cve":"CVE-2011-3375","published":"2012-01-19","fixed":"7.0.22","kev":false},{"cve":"CVE-2011-4858","published":"2012-01-05","fixed":"7.0.23","kev":false},{"cve":"CVE-2012-0022","published":"2012-01-19","fixed":"7.0.23","kev":false,"link":{"from":"CVE-2011-3375","to":"CVE-2012-0022","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.22","toFixed":"7.0.23","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.34","toFixed":"6.0.35","daysApart":0}]}},{"cve":"CVE-2012-3544","published":"2013-06-01","fixed":"7.0.30","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}