Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:30753
HistoryMay 29, 2014 - 12:00 a.m.

[SECURITY] CVE-2014-0095 Apache Tomcat denial of service

2014-05-2900:00:00
vulners.com
81

EPSS

0.03

Percentile

91.0%

CVE-2014-0095 Denial of Service

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:

  • Apache Tomcat 8.0.0-RC2 to 8.0.3

Description:
A regression was introduced in revision 1519838 that caused AJP
requests to hang if an explicit content length of zero was set on the
request. The hanging request consumed a request processing thread which
could lead to a denial of service.

Mitigation:
Users of affected versions should apply one of the following mitigations

  • Upgrade to Apache Tomcat 8.0.5 or later
    (8.0.4 contains the fix but was not released)

Credit:
This issue was reported as a possible bug via the Tomcat users mailing
list and the security implications were identified by theTomcat security
team.

References:
[1] http://tomcat.apache.org/security-8.html