Red Hat Security Advisory

RHSA-2014:0373

Apache Commons Fileupload and JBoss Web security update

Released 2014-04-03 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss BPMS 6.0
Red Hat JBoss BRMS 6.0

Fixes 2 records

TI-2014-00048 CVE-2014-0050 · GHSA-xx68-jfcg-xmmf

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat…

HIGH 80

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a craf…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83334 Published 2014-03-28 Partial fix · 1.3.1, 8.0.3 +1 CWE-835

TI-2013-03752 CVE-2013-4286 · GHSA-j448-j653-r3vj

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP…

MEDIUM 43

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.16206 Published 2014-02-26 Partial fix · 6.0.39, 7.0.47 +1 CWE-20