Red Hat Security AdvisoryRHSA-2014:0526
Red Hat JBoss Web Server 2.0.1 tomcat7 security update
Released 2014-05-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat7-7.0.40-13_patch_02.ep6.el5, tomcat7-admin-webapps-7.0.40-13_patch_02.ep6.el5, tomcat7-docs-webapp-7.0.40-13_patch_02.ep6.el5 +7
- Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat7-7.0.40-9_patch_02.ep6.el6, tomcat7-admin-webapps-7.0.40-9_patch_02.ep6.el6, tomcat7-docs-webapp-7.0.40-9_patch_02.ep6.el6 +7
Fixes 3 records
Priority HIGH 80
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a craf…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.83334 · Published 2014-03-28 · Partial fix · 1.3.1, 8.0.3 +1 CWE-835
Priority MEDIUM 43
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.16206 · Published 2014-02-26 · Partial fix · 6.0.39, 7.0.47 +1 CWE-20
Priority LOW 38
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP heade…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.09095 · Published 2014-02-26 · Partial fix · 6.0.39, 7.0.50 +1 CWE-20
THREATIST.IORead the docs