GHSA-fvm3-cfvj-gxqq
High severity vulnerability that affects commons-fileupload:commons-fileupload
At a glance
- Published
- Updated
- CVE
- CVE-2016-3092
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Affected packages
| Package | Versions |
|---|---|
| Maven · commons-fileupload:commons-fileupload | introduced 0, fixed 1.3.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3092 ADVISORY
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html WEB
- https://www.oracle.com/security-alerts/cpuapr2020.html WEB
- https://web.archive.org/web/20171111060434/http://www.securitytracker.com/id/1039606 WEB
- https://web.archive.org/web/20171103224941/http://www.securitytracker.com/id/1036900 WEB
- https://web.archive.org/web/20170317103106/http://www.securitytracker.com/id/1037029 WEB
- https://web.archive.org/web/20160924080828/http://www.securityfocus.com/bid/91453 WEB
- https://web.archive.org/web/20160726114129/http://www.securitytracker.com/id/1036427 WEB
- https://security.netapp.com/advisory/ntap-20190212-0001 WEB
- https://security.gentoo.org/glsa/202107-39 WEB
- https://security.gentoo.org/glsa/201705-09 WEB
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E WEB
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759 WEB
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840 WEB
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371 WEB
- https://github.com/advisories/GHSA-fvm3-cfvj-gxqq ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=1349468 WEB
- https://access.redhat.com/errata/RHSA-2017:0456 WEB
- https://access.redhat.com/errata/RHSA-2017:0455 WEB
- http://jvn.jp/en/jp/JVN89379547/index.html WEB
- http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121 WEB
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html WEB
- http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E WEB
- http://rhn.redhat.com/errata/RHSA-2016-2068.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-2069.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-2070.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-2071.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-2072.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-2599.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-2807.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-2808.html WEB
- http://rhn.redhat.com/errata/RHSA-2017-0457.html WEB
- http://svn.apache.org/viewvc?view=revision&revision=1743480 WEB
- http://svn.apache.org/viewvc?view=revision&revision=1743722 WEB
- http://svn.apache.org/viewvc?view=revision&revision=1743738 WEB
- http://svn.apache.org/viewvc?view=revision&revision=1743742 WEB
- http://tomcat.apache.org/security-7.html WEB
- http://tomcat.apache.org/security-8.html WEB
- http://tomcat.apache.org/security-9.html WEB
- http://www.debian.org/security/2016/dsa-3609 WEB
- http://www.debian.org/security/2016/dsa-3611 WEB
- http://www.debian.org/security/2016/dsa-3614 WEB
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html WEB
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html WEB
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |