CVE-2012-0022: Medium severity Apache Tomcat vulnerability
Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
Other sources
From the upstream advisory [1]:
Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause large amounts of CPU to be used which in turn could create a denial of service. The issue was addressed by modifying the Tomcat parameter handling code to efficiently process large numbers of parameters and parameter values.
Upstream has released 7.0.23, 6.0.35 and 5.5.35 to correct this flaw. Earlier versions of Tomcat may also be affected.
[1] http://seclists.org/bugtraq/2012/Jan/111
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0022?
CVE-2012-0022 has a high severity rating as it can lead to denial of service by consuming CPU resources.
How do I fix CVE-2012-0022?
To fix CVE-2012-0022, upgrade to Apache Tomcat version 5.5.35, 6.0.34, or 7.0.23 or later.
What versions of Apache Tomcat are affected by CVE-2012-0022?
CVE-2012-0022 affects Apache Tomcat versions 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23.
What type of attack does CVE-2012-0022 facilitate?
CVE-2012-0022 facilitates denial of service attacks through the submission of a large number of parameters in requests.
Is CVE-2012-0022 a remote vulnerability?
Yes, CVE-2012-0022 is a remote vulnerability allowing attackers to exploit it without physical access.