CVE-2014-0230

תיאור (מקור, אנגלית)

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.

מדדים

CWE

CWE-399

מוצרים מושפעים

apache: tomcat; oracle: virtualization

קישורים

• http://mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949‮… Vendor Advisory
• http://tomcat.apache.org/security-6.html PatchVendor Advisory
• http://tomcat.apache.org/security-7.html PatchVendor Advisory
• http://tomcat.apache.org/security-8.html PatchVendor Advisory
• http://mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949‮… Vendor Advisory
• http://tomcat.apache.org/security-6.html PatchVendor Advisory
• http://tomcat.apache.org/security-7.html PatchVendor Advisory
• http://tomcat.apache.org/security-8.html PatchVendor Advisory
• http://marc.info/?l=bugtraq&m=144498216801440&w=2
• http://marc.info/?l=bugtraq&m=145974991225029&w=2