Lucene search

Veracode Vulnerability DatabaseVERACODE:11560

HistoryJan 15, 2019 - 9:03 a.m.

Denial Of Service (DoS) Memory Consumption

2019-01-1509:03:54

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

JSON

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (memory consumption) via a series of aborted upload attempts.

CPENameOperatorVersion
mod_clustereq1.2.9__1.Final_redhat_1.1.ep6.el6
mod_clustereq1.2.4__1.Final_redhat_1.ep6.el6
mod_clustereq1.3.1__5.Final_redhat_2.1.ep7.el7
mod_clustereq1.2.12__1.Final_redhat_1.1.ep6.el6
mod_clustereq1.0.10__12.2.GA_CP04.ep5.el6
mod_clustereq1.2.11__1.Final_redhat_1.1.ep6.el6
mod_clustereq1.3.1__5.Final_redhat_2.1.ep7.el6
mod_clustereq1.2.9__1.Final_redhat_1.1.ep6.el7
mod_clustereq1.0.10__3.2.GA_CP02.ep5.el6
mod_clustereq1.0.10__4.1.GA_CP02_patch01.ep5.el6

Name	Operator	Version
mod_cluster	eq	1.2.9__1.Final_redhat_1.1.ep6.el6
mod_cluster	eq	1.2.4__1.Final_redhat_1.ep6.el6
mod_cluster	eq	1.3.1__5.Final_redhat_2.1.ep7.el7
mod_cluster	eq	1.2.12__1.Final_redhat_1.1.ep6.el6
mod_cluster	eq	1.0.10__12.2.GA_CP04.ep5.el6
mod_cluster	eq	1.2.11__1.Final_redhat_1.1.ep6.el6
mod_cluster	eq	1.3.1__5.Final_redhat_2.1.ep7.el6
mod_cluster	eq	1.2.9__1.Final_redhat_1.1.ep6.el7
mod_cluster	eq	1.0.10__3.2.GA_CP02.ep5.el6
mod_cluster	eq	1.0.10__4.1.GA_CP02_patch01.ep5.el6

Rows per page:

1-10 of 36581

References

mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949D1.8030904%40apache.org%3E

marc.info/?l=bugtraq&m=144498216801440&w=2

marc.info/?l=bugtraq&m=145974991225029&w=2

openwall.com/lists/oss-security/2015/04/10/1

rhn.redhat.com/errata/RHSA-2015-1621.html

rhn.redhat.com/errata/RHSA-2015-1622.html

rhn.redhat.com/errata/RHSA-2015-2661.html

rhn.redhat.com/errata/RHSA-2016-0595.html

rhn.redhat.com/errata/RHSA-2016-0596.html

rhn.redhat.com/errata/RHSA-2016-0597.html

rhn.redhat.com/errata/RHSA-2016-0598.html

rhn.redhat.com/errata/RHSA-2016-0599.html

svn.apache.org/viewvc?view=revision&revision=1603770

svn.apache.org/viewvc?view=revision&revision=1603775

svn.apache.org/viewvc?view=revision&revision=1603779

tomcat.apache.org/security-6.html

tomcat.apache.org/security-7.html

tomcat.apache.org/security-8.html

www.debian.org/security/2016/dsa-3447

www.debian.org/security/2016/dsa-3530

www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

www.securityfocus.com/bid/74475

www.ubuntu.com/usn/USN-2654-1

www.ubuntu.com/usn/USN-2655-1

access.redhat.com/errata/RHEA-2015:1771

access.redhat.com/errata/RHSA-2015:2659

access.redhat.com/errata/RHSA-2015:2660

access.redhat.com/security/cve/CVE-2014-0230

access.redhat.com/security/cve/CVE-2014-8111

access.redhat.com/security/cve/CVE-2015-0288

bugzilla.redhat.com/show_bug.cgi?id=1219753

h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013

h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964

issues.jboss.org/browse/JWS-110

issues.jboss.org/browse/JWS-219

issues.jboss.org/browse/JWS-220

lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

JSON

Related for VERACODE:11560