Description
org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | tomcat6 +8 | 6.0.24-52.el6_4 | RHSA-2013:0623 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 2 | tomcat6 +9 | 6.0.35-6_patch_06.ep6.el5 | RHSA-2013:0266 |
Advisories 2
- RHSA-2013:0623 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0266 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- SSRT101139 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1340218
- openSUSE-SU-2013:0161 vendor-advisory
- USN-1685-1 vendor-advisory
- 1027836 vdb-entry
- openSUSE-SU-2013:0192 vendor-advisory
- SSRT101182 vendor-advisory
- https://issues.apache.org/bugzilla/show_bug.cgi?id=52858
- openSUSE-SU-2013:0170 vendor-advisory
- http://tomcat.apache.org/security-7.html
- http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/tomcat/util/net/NioEndpoint.java?r1=1340218&r2=1340217&pathrev=1340218
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1340218&r2=1340217&pathrev=1340218
- RHSA-2013:0623 vendor-advisory
- 20121204 CVE-2012-4534 Apache Tomcat denial of service mailing-list
- oval:org.mitre.oval:def:19398 vdb-entry signature
- 56813 vdb-entry
- HPSBST02955 vendor-advisory