Vulnerabilidad en java/org/apache/coyote/http11/filters/ChunkedInputFilter.java en Apache Tomcat (CVE-2014-0227)
Gravedad CVSS v2.0:
MEDIA
Tipo:
CWE-19
Errores en el procesamiento de datos
Fecha de publicación:
16/02/2015
Última modificación:
12/04/2025
Descripción
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java en Apache Tomcat 6.x anterior a 6.0.42, 7.x anterior a 7.0.55, y 8.x anterior a 8.0.9 no maneja correctamente los intentos de seguir leyendo datos después de un error haya ocurrido, lo que permite a atacantes remotos realizar ataques de la infiltración de solicitudes HTTP o causar una denegación de servicio (consumo de recursos) mediante la transmisión de datos con la codificación malformada de transferencias fragmentadas.
Impacto
Puntuación base 2.0
6.40
Gravedad 2.0
MEDIA
Productos y versiones vulnerables
CPE | Desde | Hasta |
---|---|---|
cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* | ||
cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://advisories.mageia.org/MGASA-2015-0081.html
- http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
- http://marc.info/?l=bugtraq&m=143393515412274&w=2
- http://marc.info/?l=bugtraq&m=143393515412274&w=2
- http://marc.info/?l=bugtraq&m=143403519711434&w=2
- http://marc.info/?l=bugtraq&m=143403519711434&w=2
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
- http://rhn.redhat.com/errata/RHSA-2015-0983.html
- http://rhn.redhat.com/errata/RHSA-2015-0991.html
- http://svn.apache.org/viewvc?view=revision&revision=1600984
- http://tomcat.apache.org/security-6.html
- http://tomcat.apache.org/security-7.html
- http://tomcat.apache.org/security-8.html
- http://www.debian.org/security/2016/dsa-3447
- http://www.debian.org/security/2016/dsa-3530
- http://www.mandriva.com/security/advisories?name=MDVSA-2015%3A052
- http://www.mandriva.com/security/advisories?name=MDVSA-2015%3A053
- http://www.mandriva.com/security/advisories?name=MDVSA-2015%3A084
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.securityfocus.com/bid/72717
- http://www.securitytracker.com/id/1032791
- http://www.ubuntu.com/usn/USN-2654-1
- http://www.ubuntu.com/usn/USN-2655-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1109196
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://source.jboss.org/changelog/JBossWeb?cs=2455
- http://advisories.mageia.org/MGASA-2015-0081.html
- http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
- http://marc.info/?l=bugtraq&m=143393515412274&w=2
- http://marc.info/?l=bugtraq&m=143393515412274&w=2
- http://marc.info/?l=bugtraq&m=143403519711434&w=2
- http://marc.info/?l=bugtraq&m=143403519711434&w=2
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
- http://rhn.redhat.com/errata/RHSA-2015-0983.html
- http://rhn.redhat.com/errata/RHSA-2015-0991.html
- http://svn.apache.org/viewvc?view=revision&revision=1600984
- http://tomcat.apache.org/security-6.html
- http://tomcat.apache.org/security-7.html
- http://tomcat.apache.org/security-8.html
- http://www.debian.org/security/2016/dsa-3447
- http://www.debian.org/security/2016/dsa-3530
- http://www.mandriva.com/security/advisories?name=MDVSA-2015%3A052
- http://www.mandriva.com/security/advisories?name=MDVSA-2015%3A053
- http://www.mandriva.com/security/advisories?name=MDVSA-2015%3A084
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.securityfocus.com/bid/72717
- http://www.securitytracker.com/id/1032791
- http://www.ubuntu.com/usn/USN-2654-1
- http://www.ubuntu.com/usn/USN-2655-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1109196
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://source.jboss.org/changelog/JBossWeb?cs=2455