Description
java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat-coyote | >= 8.0.0-RC1, < 8.0.4 | 8.0.4 | GHSA-wf5v-jhxj-q632 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 8.0.0-RC1, < 8.0.4 | 8.0.4 | GHSA-wf5v-jhxj-q632 |
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21681528
- 20140527 [SECURITY] CVE-2014-0095 Apache Tomcat denial of service mailing-list
- http://tomcat.apache.org/security-8.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21678231
- 59873 third-party-advisory
- 67673 vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://svn.apache.org/viewvc?view=revision&revision=1578392
- 1030300 vdb-entry
- 60729 third-party-advisory