A vulnerability has been identified in Apache Tomcat, which could be exploited by attackers to gain knowledge of sensitive information. This issue is caused by an error when processing certain requests, which could be exploited by attackers to disclose the contents of previous POST requests.

Affected Products

Apache Tomcat versions 4.1.32 through 4.1.34
Apache Tomcat versions 5.5.10 through 5.5.20

Solution

Upgrade to Apache Tomcat 4.1.34, 5.5.21 or later :
http://tomcat.apache.org/index.html

References

http://www.vupen.com/english/advisories/2009/0541
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-4.html
http://jvn.jp/jp/JVN66905322/index.html

Credits

Vulnerability reported by JPCERT/CC.

Changelog

2009-02-26 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.