GHSA-wr3m-gw98-mc3j
Improper Input Validation in Apache Tomcat
At a glance
- Published
- Updated
- CVE
- CVE-2011-4858
Description
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 5.5.0, fixed 5.5.35 |
| Maven · org.apache.tomcat:tomcat | introduced 6.0.0, fixed 6.0.35 |
| Maven · org.apache.tomcat:tomcat | introduced 7.0.0, fixed 7.0.23 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-4858 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=750521 WEB
- https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py WEB
- https://github.com/apache/tomcat PACKAGE
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886 WEB
- http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106@apache.org%3e WEB
- http://marc.info/?l=bugtraq&m=132871655717248&w=2 WEB
- http://marc.info/?l=bugtraq&m=133294394108746&w=2 WEB
- http://marc.info/?l=bugtraq&m=136485229118404&w=2 WEB
- http://rhn.redhat.com/errata/RHSA-2012-0074.html WEB
- http://rhn.redhat.com/errata/RHSA-2012-0075.html WEB
- http://rhn.redhat.com/errata/RHSA-2012-0076.html WEB
- http://tomcat.apache.org/tomcat-7.0-doc/changelog.html WEB
- http://www.debian.org/security/2012/dsa-2401 WEB
- http://www.kb.cert.org/vuls/id/903934 WEB
- http://www.nruns.com/_downloads/advisory28122011.pdf WEB
- http://www.ocert.org/advisories/ocert-2011-003.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |