CVE-2014-5019: Input Validation
Published Jul 22, 2014
·Updated
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.
Affected Software
86 affected components
Drupal Drupal=7.0
Drupal Drupal=7.0-alpha1
Drupal Drupal=7.0-alpha2
Drupal Drupal=7.0-alpha3
Drupal Drupal=7.0-alpha4
Drupal Drupal=7.0-alpha5
Drupal Drupal=7.0-alpha6
Drupal Drupal=7.0-alpha7
Drupal Drupal=7.0-beta1
Drupal Drupal=7.0-beta2
Drupal Drupal=7.0-beta3
Drupal Drupal=7.0-dev
Drupal Drupal=7.0-rc1
Drupal Drupal=7.0-rc2
Drupal Drupal=7.0-rc3
Drupal Drupal=7.0-rc4
Drupal Drupal=7.1
Drupal Drupal=7.2
Drupal Drupal=7.3
Drupal Drupal=7.4
Drupal Drupal=7.5
Drupal Drupal=7.6
Drupal Drupal=7.7
Drupal Drupal=7.8
Drupal Drupal=7.9
Drupal Drupal=7.10
Drupal Drupal=7.11
Drupal Drupal=7.12
Drupal Drupal=7.13
Drupal Drupal=7.14
Drupal Drupal=7.15
Drupal Drupal=7.16
Drupal Drupal=7.17
Drupal Drupal=7.18
Drupal Drupal=7.19
Drupal Drupal=7.20
Drupal Drupal=7.21
Drupal Drupal=7.22
Drupal Drupal=7.23
Drupal Drupal=7.24
Drupal Drupal=7.25
Drupal Drupal=7.26
Drupal Drupal=7.27
Drupal Drupal=7.28
Drupal Drupal=7.x-dev
Drupal Drupal=6.0
Drupal Drupal=6.0-beta1
Drupal Drupal=6.0-beta2
Drupal Drupal=6.0-beta3
Drupal Drupal=6.0-beta4
Drupal Drupal=6.0-dev
Drupal Drupal=6.0-rc1
Drupal Drupal=6.0-rc2
Drupal Drupal=6.0-rc3
Drupal Drupal=6.0-rc4
Drupal Drupal=6.1
Drupal Drupal=6.2
Drupal Drupal=6.3
Drupal Drupal=6.4
Drupal Drupal=6.5
Drupal Drupal=6.6
Drupal Drupal=6.7
Drupal Drupal=6.8
Drupal Drupal=6.9
Drupal Drupal=6.10
Drupal Drupal=6.11
Drupal Drupal=6.12
Drupal Drupal=6.13
Drupal Drupal=6.14
Drupal Drupal=6.15
Drupal Drupal=6.16
Drupal Drupal=6.17
Drupal Drupal=6.18
Drupal Drupal=6.19
Drupal Drupal=6.20
Drupal Drupal=6.21
Drupal Drupal=6.22
Drupal Drupal=6.23
Drupal Drupal=6.24
Drupal Drupal=6.25
Drupal Drupal=6.26
Drupal Drupal=6.27
Drupal Drupal=6.28
Drupal Drupal=6.29
Drupal Drupal=6.30
Drupal Drupal=6.31
Remediation
Patch Available
Event History
Jul 22, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-5019?
CVE-2014-5019 has a severity rating of medium, affecting the Drupal multisite feature.
2
How do I fix CVE-2014-5019?
To fix CVE-2014-5019, upgrade to Drupal 6.32 or 7.29 or later.
3
What impacts does CVE-2014-5019 have on my Drupal site?
CVE-2014-5019 may allow remote attackers to cause a denial of service by sending a crafted HTTP Host header.
4
Which versions of Drupal are affected by CVE-2014-5019?
CVE-2014-5019 affects Drupal versions 6.x before 6.32 and 7.x before 7.29.
5
Is there a workaround for CVE-2014-5019 if I cannot upgrade?
There are no specific workarounds for CVE-2014-5019; upgrading is the recommended solution.