{"id":"CVE-2008-3271","aliases":["EUVD-2008-3259","GHSA-5jpg-mjvg-hfhp","RHSA-2008:1007"],"status":"published","title":"Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address...","description":"Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a \"synchronization problem\" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04807,"percentile":0.9201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2008-10-13T18:00:00Z","modified":"2026-06-16T22:55:30Z","affected":[{"source":"osv","ecosystem":"Red Hat:network_satellite:5.1::el4","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.30-0jpp_12rh"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.0:el4","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.30-0jpp_12rh"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://tomcat.apache.org/security-4.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200806e.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.nec.co.jp/security-info/secinfo/nv09-006.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2008/2800","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://secunia.com/advisories/32234","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/497220/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://secunia.com/advisories/32398","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=25835","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2009/1818","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://securityreason.com/securityalert/4396","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"]},{"url":"http://www.securityfocus.com/bid/31698","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://secunia.com/advisories/35684","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2008/2793","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://tomcat.apache.org/security-5.html","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://www.securitytracker.com/id?1021039","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45791","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://jvn.jp/en/jp/JVN30732239/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred"]},{"url":"http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000069.html","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred"]},{"url":"http://secunia.com/advisories/32213","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-3271","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-5jpg-mjvg-hfhp"},{"url":"https://access.redhat.com/errata/RHSA-2008:1007","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=446393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=456120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=457597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=457934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=466875","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_1007.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-1232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1232","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-1947","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1947","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-2370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2370","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2370","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-2938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2938","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-3271","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-3271","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2008-3271","description":"Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a \"synchronization problem\" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.","status":"published","published":"2008-10-13T18:00:00Z","modified":"2024-08-07T09:28:41.943Z","updated_at":"2026-11-02T14:34:45.504702Z"}],"euvd":[{"id":"EUVD-2008-3259","description":"Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a \"synchronization problem\" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.","status":"published","published":"2008-10-13T18:00:00Z","modified":"2024-08-07T09:28:41Z","updated_at":"2026-11-03T01:38:53.185771Z"}],"ghsa":[{"id":"GHSA-5jpg-mjvg-hfhp","title":"Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address...","description":"Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a \"synchronization problem\" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.","status":"published","published":"2022-05-01T23:58:23Z","modified":"2023-02-20T05:05:40Z","updated_at":"2026-11-02T14:54:10.77374Z"}],"nvd":[{"id":"CVE-2008-3271","description":"Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a \"synchronization problem\" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.","status":"published","published":"2008-10-13T20:00:02.057Z","modified":"2026-06-16T22:55:30.52Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:01:29.223028Z"}],"osv":[{"id":"RHSA-2008:1007","title":"Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server","status":"published","published":"2024-09-15T17:37:35Z","modified":"2025-11-22T10:18:51Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}