[SECURITY] CVE-2014-0095 Apache Tomcat denial of service

From: Mark Thomas <markt@apache.org>
To: Tomcat Users List <users@tomcat.apache.org>
Cc: Tomcat Developers List <dev@tomcat.apache.org>,announce@apache.org,announce@tomcat.apache.org,fulldisclosure@seclists.org,bugtraq@securityfocus.com
Subject: [SECURITY] CVE-2014-0095 Apache Tomcat denial of service
Date:


CVE-2014-0095 Denial of Service

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
- Apache Tomcat 8.0.0-RC2 to 8.0.3

Description:
A regression was introduced in  revision 1519838 that caused AJP
requests to hang if an explicit content length of zero was set on the
request. The hanging request consumed a request processing thread which
could lead to a denial of service.

Mitigation:
Users of affected versions should apply one of the following mitigations
- Upgrade to Apache Tomcat 8.0.5 or later
  (8.0.4 contains the fix but was not released)

Credit:
This issue was reported as a possible bug via the Tomcat users mailing
list and the security implications were identified by theTomcat security
team.

References:
[1] http://tomcat.apache.org/security-8.html





Copyright © 1995-2018 LinuxRocket.net. All rights reserved.