Description
Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
Remediation
References
Related Vulnerabilities
ownCloud Other Vulnerability (CVE-2022-25339)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3543)
IBM WebSEAL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1886)
Oracle JRE CVE-2018-2634 Vulnerability (CVE-2018-2634)
MyBB URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2018-10678)