CVE-2013-4322: Input Validation
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
Other sources
The fix for CVE-2012-3544 was not complete. It did not cover the following cases:
a) Chunk extensions were not limited b) Whitespace after the : in a trailing header was not limited
This has been corrected in upstream versions 8.0.0-rc10 [1],[2], 7.0.50 [3],[4], and 6.0.39 [5]
[1] http://svn.apache.org/viewvc?view=revision&revision=1521834 [2] http://svn.apache.org/viewvc?view=revision&revision=1549522 [3] http://svn.apache.org/viewvc?view=revision&revision=1521864 [4] http://svn.apache.org/viewvc?view=revision&revision=1549523 [5] http://svn.apache.org/viewvc?view=revision&revision=1556540
This could lead to a remote attacker causing a denial of service by streaming data, because Tomcat did not fully handle chunk extensions in chunked transfer coding.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4322?
CVE-2013-4322 has a severity rating that can lead to denial of service attacks.
How do I fix CVE-2013-4322?
To fix CVE-2013-4322, upgrade Apache Tomcat to version 6.0.39, 7.0.50, or 8.0.0-RC10 or later.
What are the affected versions of Apache Tomcat for CVE-2013-4322?
The affected versions are Apache Tomcat versions prior to 6.0.39, 7.0.50, and 8.0.0-RC10.
Can CVE-2013-4322 be exploited remotely?
Yes, attackers can exploit CVE-2013-4322 remotely to cause denial of service.
What types of issues does CVE-2013-4322 cause in Apache Tomcat?
CVE-2013-4322 causes issues with processing chunked transfer coding, leading to potential service disruptions.