Skip to main content

CVE-2014-0050

Severity

7.5

Description

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue or limiting the size of the Content Header of a multipart request to 4091 bytes or less.

Project

Apache Tomcat

Apache TomEE

Category
n/a
Tags
operational
functional
Date Disclosed

2014-04-01

Date Discovered

2013-12-03

Apache Tomcat 8.0.x

First release:
2014-06-25
First release:
2018-06-30
CVEs:
50
Support Lifecycle:
Namespace:
javax

Apache TomEE 1.6.x

First release:
2013-11-17
CVEs:
101
Support Lifecycle:
Namespace:
javax

Apache TomEE 1.5.x

First release:
2012-09-28
CVEs:
111
Support Lifecycle:
Namespace:
javax

Apache TomEE 1.0.x

First release:
2012-04-27
CVEs:
121
Support Lifecycle:
Namespace:
javax
Feel Vulnerable? 

Contact us so we can help you.

* These fields are required.