tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ma...@apache.org
Subject svn commit: r535546 - in /tomcat/site/trunk: docs/security-4.html xdocs/security-4.xml
Date Sat, 05 May 2007 16:33:46 GMT
Author: markt
Date: Sat May  5 09:33:44 2007
New Revision: 535546

URL: http://svn.apache.org/viewvc?view=rev&rev=535546
Log:
Add information on CVE-2005-3164

Modified:
    tomcat/site/trunk/docs/security-4.html
    tomcat/site/trunk/xdocs/security-4.xml

Modified: tomcat/site/trunk/docs/security-4.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-4.html?view=diff&rev=535546&r1=535545&r2=535546
==============================================================================
--- tomcat/site/trunk/docs/security-4.html (original)
+++ tomcat/site/trunk/docs/security-4.html Sat May  5 09:33:44 2007
@@ -250,6 +250,43 @@
 <tr>
 <td bgcolor="#525D76">
 <font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Fixed in Apache Tomcat 4.1.HEAD">
+<strong>Fixed in Apache Tomcat 4.1.HEAD</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+    <p>
+<strong>important: Information disclosure</strong>
+       <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3164">
+       CVE-2005-3164</a>
+</p>
+
+    <p>If a client specifies a Content-Length but disconnects before sending
+       any of the request body, the deprecated AJP connector processes the
+       request using the request body of the previous request. Users are advised
+       to use the default, supported Coyote AJP connector which does not exhibit
+       this issue.</p>
+
+    <p>Affects: 4.0.1-4.0.6, 4.1.0-4.1.HEAD</p>
+  </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
 <a name="Fixed in Apache Tomcat 4.1.36">
 <strong>Fixed in Apache Tomcat 4.1.36</strong>
 </a>

Modified: tomcat/site/trunk/xdocs/security-4.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-4.xml?view=diff&rev=535546&r1=535545&r2=535546
==============================================================================
--- tomcat/site/trunk/xdocs/security-4.xml (original)
+++ tomcat/site/trunk/xdocs/security-4.xml Sat May  5 09:33:44 2007
@@ -40,6 +40,20 @@
     <p>Affects: 4.1.15-4.1.HEAD</p>
   </section>
 
+  <section name="Fixed in Apache Tomcat 4.1.HEAD">
+    <p><strong>important: Information disclosure</strong>
+       <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3164">
+       CVE-2005-3164</a></p>
+
+    <p>If a client specifies a Content-Length but disconnects before sending
+       any of the request body, the deprecated AJP connector processes the
+       request using the request body of the previous request. Users are advised
+       to use the default, supported Coyote AJP connector which does not exhibit
+       this issue.</p>
+
+    <p>Affects: 4.0.1-4.0.6, 4.1.0-4.1.HEAD</p>
+  </section>
+
   <section name="Fixed in Apache Tomcat 4.1.36">
     <p><strong>important: Information disclosure</strong>
        <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2090">



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message