Skip to content
OpenAdvisories
High RHSA-2014:0526 3 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-admin-webapps 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-docs-webapp 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-el-2.2-api 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-javadoc 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-jsp-2.2-api 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-lib 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-log4j 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-servlet-3.0-api 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat7-webapps 0:7.0.40-13_patch_02.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-admin-webapps 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-docs-webapp 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-el-2.2-api 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-javadoc 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-jsp-2.2-api 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-lib 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-log4j 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-servlet-3.0-api 0:7.0.40-9_patch_02.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat7-webapps 0:7.0.40-9_patch_02.ep6.el6

Vulnerabilities 3

  • High 7.5
    CVE-2014-0050 Public exploit EPSS 83%

    Commons FileUpload Denial of service vulnerability

    MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a…

    org.apache.tomcat:tomcat commons-fileupload:commons-fileupload libcommons-fileupload-java Debian Maven
  • Medium —
    CVE-2013-4286 EPSS 16%

    Apache Tomcat is vulnerable to HTTP request-smuggling

    Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2013-4322 Public exploit

    Apache Tomcat Denial of Service vulnerability

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which a…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1062337
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069905
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069921
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0526.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-4286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4286
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4286
  • report
    https://access.redhat.com/security/cve/CVE-2013-4322
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4322
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4322
  • report
    https://access.redhat.com/security/cve/CVE-2014-0050
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0050
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0050