Two vulnerabilities have been identified in Apache Tomcat, which could be exploited to cause a denial of service or disclose sensitive information.
The first issue is caused due to insufficient error checking in some authentication classes, which could allow attackers to enumeration valid usernames by sending specially crafted URL-encoded passwords to a server when FORM based authenticiaton (j_security_check) is used with "MemoryRealm", "DataSourceRealm" or "JDBCRealm".
The second vulnerability is caused due to Tomcat closing AJP connections when processing a request with invalid headers via the Java AJP connector, which could cause a member of a mod_jk load balancing worker to be blocked for a limited time, creating a denial of service condition.
