Read the docs
Red Hat Security Advisory

RHSA-2014:0528

Red Hat JBoss Web Server 2.0.1 tomcat6 security update

Released 2014-05-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2014-00048 CVE-2014-0050 · GHSA-xx68-jfcg-xmmf

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat…

Priority HIGH 80

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a craf…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83334 Published 2014-03-28 Partial fix · 1.3.1, 8.0.3 +1 CWE-835
TI-2013-03752 CVE-2013-4286 · GHSA-j448-j653-r3vj

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP…

Priority MEDIUM 43

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.16206 Published 2014-02-26 Partial fix · 6.0.39, 7.0.47 +1 CWE-20
TI-2013-03787 CVE-2013-4322 · GHSA-wq2p-q66w-q8gp

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes…

Priority LOW 38

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP heade…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09095 Published 2014-02-26 Partial fix · 6.0.39, 7.0.50 +1 CWE-20
TI-2014-00031 CVE-2014-0033 · GHSA-6gjj-c5mj-4cvp

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37…

Priority LOW 32

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct sess…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09895 Published 2014-02-26 Partial fix · 6.0.38 CWE-20