This vulnerability was originally reported to the Apache Software Foundation as a Tomcat vulnerability. Investigations quickly identified that the root cause was an issue with the UTF-8 charset implementation within the JVM. The issue existed in multiple JVMs including current versions from Sun, HP, IBM, Apple and Apache. It was decided to continue to report this as a Tomcat vulnerability until such time as the JVM vendors had released fixed versions.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/73193/CVE-2008-2938-2.txt
Source: https://packetstormsecurity.com/files/73193/Apache-Tomcat-Information-Disclosure.html