CVE-2014-0227

Severity

6.4

Description

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0227

http://tools.cisco.com/security/center/viewAlert.x?alertId=37408

http://www-01.ibm.com/support/docview.wss?uid=swg21959707

https://bugzilla.redhat.com/show_bug.cgi?id=1109196

Project

Apache Tomcat

Category

n/a

Tags

operational

Date Disclosed

2015-02-15

Date Discovered

2013-12-03

Apache Tomcat 8.0.x

First release:

2014-06-25

First release:

2018-06-30

CVEs:

55

Support Lifecycle:

Namespace:

javax

8.0.1 8.0.3 8.0.5 8.0.8

Apache TomEE 1.6.x

First release:

2013-11-17

CVEs:

108

Support Lifecycle:

Namespace:

javax

1.6.0 1.6.0.1 1.6.0.2

Apache TomEE 1.5.x

First release:

2012-09-28

CVEs:

119

Support Lifecycle:

Namespace:

javax

1.5.0 1.5.1 1.5.2

Apache TomEE 1.0.x

First release:

2012-04-27

CVEs:

130

Support Lifecycle:

Namespace:

javax

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.