--- title: "CVE-2007-6286\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2007-6286?format=md keywords: index, follow --- # CVE-2007-6286 Publication date 12 February 2008 Last updated 24 July 2024 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request. [Read the notes from the security team](https://ubuntu.com/security/CVE-2007-6286?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | tomcat5 | 9.10 karmic | Not in release | | 9.04 jaunty | Not in release | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Not in release | | 7.10 gutsy | Not in release | | 7.04 feisty | Ignored end of life, was needed | | 6.10 edgy | Ignored end of life, was needed | | 6.06 LTS dapper | Ignored end of life | | tomcat5.5 | 9.10 karmic | Not in release | | 9.04 jaunty | Not affected | | 8.10 intrepid | Not affected | | 8.04 LTS hardy | Not affected | | 7.10 gutsy | Not affected | | 7.04 feisty | Not affected | | 6.10 edgy | Not affected | | 6.06 LTS dapper | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [fujitsu](https://launchpad.net/~fujitsu) At least 5.5 doesn't use the native APR connector. ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6286) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2007-6286) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2007-6286) * [Debian](https://security-tracker.debian.org/tracker/CVE-2007-6286) ### Other references *