[SECURITY] CVE-2014-0095 Apache Tomcat denial of service

2014-05-29T00:00:00
ID SECURITYVULNS:DOC:30753
Type securityvulns
Reporter Securityvulns
Modified 2014-05-29T00:00:00

Description

CVE-2014-0095 Denial of Service

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: - Apache Tomcat 8.0.0-RC2 to 8.0.3

Description: A regression was introduced in revision 1519838 that caused AJP requests to hang if an explicit content length of zero was set on the request. The hanging request consumed a request processing thread which could lead to a denial of service.

Mitigation: Users of affected versions should apply one of the following mitigations - Upgrade to Apache Tomcat 8.0.5 or later (8.0.4 contains the fix but was not released)

Credit: This issue was reported as a possible bug via the Tomcat users mailing list and the security implications were identified by theTomcat security team.

References: [1] http://tomcat.apache.org/security-8.html