GHSA-42j3-498q-m6vp
Improper Input Validation in Apache Tomcat
At a glance
- Published
- Updated
- CVE
- CVE-2014-0227
Description
`java/org/apache/coyote/http11/filters/ChunkedInputFilter.java` in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 6.0.0, fixed 6.0.42 |
| Maven · org.apache.tomcat:tomcat | introduced 7.0.0, fixed 7.0.55 |
| Maven · org.apache.tomcat:tomcat | introduced 8.0.0, fixed 8.0.9 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-0227 ADVISORY
- https://github.com/apache/tomcat/commit/593a2447e6ebe465585cfa07e93b5635dffa1c70 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1109196 WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E WEB
- https://source.jboss.org/changelog/JBossWeb?cs=2455 WEB
- http://advisories.mageia.org/MGASA-2015-0081.html WEB
- http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html WEB
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html WEB
- http://marc.info/?l=bugtraq&m=143393515412274&w=2 WEB
- http://marc.info/?l=bugtraq&m=143403519711434&w=2 WEB
- http://rhn.redhat.com/errata/RHSA-2015-0675.html WEB
- http://rhn.redhat.com/errata/RHSA-2015-0720.html WEB
- http://rhn.redhat.com/errata/RHSA-2015-0765.html WEB
- http://rhn.redhat.com/errata/RHSA-2015-0983.html WEB
- http://rhn.redhat.com/errata/RHSA-2015-0991.html WEB
- http://svn.apache.org/viewvc?view=revision&revision=1600984 WEB
- http://tomcat.apache.org/security-6.html WEB
- http://tomcat.apache.org/security-7.html WEB
- http://tomcat.apache.org/security-8.html WEB
- http://www.debian.org/security/2016/dsa-3447 WEB
- http://www.debian.org/security/2016/dsa-3530 WEB
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html WEB
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html WEB
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html WEB
- http://www.ubuntu.com/usn/USN-2654-1 WEB
- http://www.ubuntu.com/usn/USN-2655-1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |