Improper Input Validation in Apache Tomcat
`java/org/apache/coyote/http11/filters/ChunkedInputFilter.java` in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-0227US | medium6.4 | — | ||
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to conti… | ||||
02
references
External citations — patches, advisories, analysis.
- http://advisories.mageia.org/MGASA-2015-0081.htmlWEB
- http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.htmlWEB
- http://marc.info/?l=bugtraq&m=143393515412274&w=2WEB
- http://marc.info/?l=bugtraq&m=143403519711434&w=2WEB
- http://rhn.redhat.com/errata/RHSA-2015-0675.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0720.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0765.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan