CVE-2014-0230: High severity Apache Tomcat vulnerability
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Other sources
When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection.
Upstream fix:
http://svn.apache.org/viewvc?view=revision&revision=1603781 http://svn.apache.org/viewvc?view=revision&revision=1603811 http://svn.apache.org/viewvc?view=revision&revision=1609176 http://svn.apache.org/viewvc?view=revision&revision=1659295
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.0.9 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 7.0.55 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 6.0.44 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 6.0.44 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.55 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.9 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 6.0.44 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 7.0.55 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 8.0.9
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0230?
CVE-2014-0230 has a medium severity rating due to its potential to cause denial of service attacks.
How do I fix CVE-2014-0230?
To fix CVE-2014-0230, upgrade to Apache Tomcat version 6.0.44 or later, 7.0.55 or later, or 8.0.9 or later.
What versions of Apache Tomcat are affected by CVE-2014-0230?
CVE-2014-0230 affects Apache Tomcat versions 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9.
Can CVE-2014-0230 be exploited remotely?
Yes, CVE-2014-0230 can be exploited remotely by attackers, allowing them to execute denial of service attacks.
What are the implications of CVE-2014-0230 for my web applications?
The implications of CVE-2014-0230 include thread consumption and potential service disruption for web applications running on the affected versions of Tomcat.