---
title: "CVE-2011-3190\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2011-3190?format=md
keywords: index, follow
---

# CVE-2011-3190

Publication date 31 August 2011

Last updated 24 July 2024

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0
through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly
other versions allow remote attackers to spoof AJP requests, bypass
authentication, and obtain sensitive information by causing the connector
to interpret a request body as a new request.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| tomcat5.5 | 11.10 oneiric | Not in release |
| 11.04 natty | Not in release |
| 10.10 maverick | Not in release |
| 10.04 LTS lucid | Not in release |
| 8.04 LTS hardy | Fixed 5.5.25-5ubuntu1.3 |
| tomcat6 | 11.10 oneiric | Not affected |
| 11.04 natty | Fixed 6.0.28-10ubuntu2.2 |
| 10.10 maverick | Fixed 6.0.28-2ubuntu1.5 |
| 10.04 LTS lucid | Fixed 6.0.24-2ubuntu1.9 |
| 8.04 LTS hardy | Not in release |
| tomcat7 | 11.10 oneiric | Fixed 7.0.21-1 |
| 11.04 natty | Not in release |
| 10.10 maverick | Not in release |
| 10.04 LTS lucid | Not in release |
| 8.04 LTS hardy | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2011-3190?format=md#patch-details)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| tomcat5.5 | * Other:   <http://svn.apache.org/viewvc?rev=1162960&view=rev> |
| tomcat6 | * Other:   <http://svn.apache.org/viewvc?rev=1162959&view=rev> |
| tomcat7 | * Other:   <http://svn.apache.org/viewvc?rev=1162958&view=rev> |

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3190)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2011-3190)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2011-3190)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2011-3190)

### Related Ubuntu Security Notices (USN)

+ [USN-1252-1](https://usn.ubuntu.com/USN-1252-1)
+ Tomcat vulnerabilities
+ 8 November 2011

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2011-3190>