Red Hat Security Advisory

RHSA-2014:0429

tomcat6 security update

Released 2014-04-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +6
Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +6
Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-el-2.1-api-6.0.24-64.el6_5, tomcat6-jsp-2.1-api-6.0.24-64.el6_5 +2
Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +2
Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-el-2.1-api-6.0.24-64.el6_5, tomcat6-jsp-2.1-api-6.0.24-64.el6_5 +2
Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +2

Fixes 3 records

TI-2014-00048 CVE-2014-0050 · GHSA-xx68-jfcg-xmmf

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat…

HIGH 80

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a craf…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83334 Published 2014-03-28 Partial fix · 1.3.1, 8.0.3 +1 CWE-835

TI-2013-03752 CVE-2013-4286 · GHSA-j448-j653-r3vj

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP…

MEDIUM 43

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.16206 Published 2014-02-26 Partial fix · 6.0.39, 7.0.47 +1 CWE-20

TI-2013-03787 CVE-2013-4322 · GHSA-wq2p-q66w-q8gp

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes…

LOW 38

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP heade…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09095 Published 2014-02-26 Partial fix · 6.0.39, 7.0.50 +1 CWE-20