CVE-2005-3164: Exposure of Sensitive Information to an Unauthorized Actor
(updated )
The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when “unsuitable request body data” is used for a different request, possibly related to Java Servlet pages.
References
- jvn.jp/jp/JVN%2379314822/index.html
- lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
- support.apple.com/kb/HT2163
- www.hitachi-support.com/security_e/vuls_e/HS05-019_e/01-e.html
- github.com/advisories/GHSA-qhqv-q4xg-f6g7
- lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
- nvd.nist.gov/vuln/detail/CVE-2005-3164
- web.archive.org/web/20051215074217/http://www.hitachi-support.com/security_e/vuls_e/HS05-019_e/01-e.html
- web.archive.org/web/20081202183445/http://www.securityfocus.com/bid/15003
Code Behaviors & Features
Detect and mitigate CVE-2005-3164 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →