Skip to content
OpenAdvisories
Unscored CVE-2014-0118 EUVD-2014-0188GHSA-m8vg-h7wr-m54w

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decomp…

Published Jul 20, 2014 · Updated Aug 6, 2024 · Assigned by redhat

Package: apache2 Package: apache2 Ecosystem: Debian Ecosystem: Ubuntu

Description

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache2 2.4.10-1 —
Debian 13 apache2 2.4.10-1 —
Debian 12 apache2 2.4.10-1 —
Debian 7 apache2 2.2.22-13+deb7u3 DSA-2989-1
Debian 6.0 apache2 2.2.16-6+squeeze13 DLA-66-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS apache2 2.4.7-1ubuntu4.1 USN-2299-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 httpd +5 2.4.6-18.el7_0 RHSA-2014:0921
RHEL 7 mod_ssl +1 1:2.4.6-18.el7_0 RHSA-2014:0921
RHEL 6 httpd +3 2.2.15-31.el6_5 RHSA-2014:0920
RHEL 6 mod_ssl 1:2.2.15-31.el6_5 RHSA-2014:0920
RHEL 5 httpd +2 2.2.3-87.el5_10 RHSA-2014:0920
RHEL 5 mod_ssl 1:2.2.3-87.el5_10 RHSA-2014:0920
RHEL 1 httpd24-httpd +5 2.4.6-18.el6 RHSA-2014:0922
RHEL 1 httpd24-mod_ssl +1 1:2.4.6-18.el6 RHSA-2014:0922
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat JBoss Web Server 2 antlr-eap6 2.7.7-17.redhat_4.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-collections-eap6 +1 3.2.1-15.redhat_3.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-daemon-eap6 1:1.0.15-5.redhat_1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-daemon-jsvc-eap6 1:1.0.15-6.redhat_2.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-logging-eap6 +1 1.1.1-7.9_redhat_1.ep6.el6 RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-pool-eap6 +1 1.6-7.redhat_6.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 dom4j-eap6 1.6.1-20.redhat_6.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 ecj3 1:3.7.2-9.redhat_3.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 hibernate4-eap6 +5 4.2.14-3.SP1_redhat_1.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 httpd +3 2.2.26-35.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 javassist-eap6 3.18.1-1.GA_redhat_1.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 jboss-logging 3.1.4-1.GA_redhat_1.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 jboss-transaction-api_1.1_spec 1.0.1-12.Final_redhat_2.2.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_cluster +2 1.2.9-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_cluster-native 1.2.9-3.Final_redhat_2.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_jk +2 1.2.40-2.redhat_1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_rt 2.4.1-6.GA.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_snmp 2.4.1-13.GA.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_ssl 1:2.2.26-35.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 storeconfig-tc6 0.0.1-7.Alpha3_redhat_12.3.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 storeconfig-tc7 0.0.1-7.Alpha3_redhat_12.5.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 tomcat-native 1.1.30-2.redhat_1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 tomcat6 +9 6.0.41-5_patch_02.ep6.el6 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 tomcat7 +9 7.0.54-6_patch_02.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss EAP 6 apache-commons-beanutils-eap6 1.8.3-7.redhat_6.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 apache-commons-cli-eap6 1.2-6.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 apache-commons-codec-eap6 1.4-16.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 apache-commons-collections-eap6 3.2.1-15.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 apache-commons-configuration-eap6 1.6-1.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 apache-commons-daemon-jsvc-eap6 1:1.0.15-6.redhat_2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 apache-commons-io-eap6 2.1-8.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 apache-commons-lang-eap6 2.6-8.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 apache-mime4j 0.6-10.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 cal10n-eap6 0.7.3-2.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 codehaus-jackson +4 1.9.9-7.redhat_3.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 ecj-eap6 4.3.1-3.redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 glassfish-jaf 1.1.1-16.redhat_2.ep6.el6 RHSA-2014:1020
Red Hat JBoss EAP 6 glassfish-jaxb-eap6 2.2.5-20.redhat_8.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 gnu-getopt-eap6 1.0.13-1.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 guava-libraries 13.0.1-3.redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 h2database 1.3.168-7.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 hibernate4-eap6 +4 4.2.14-2.SP1_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 hibernate4-validator 4.3.1-2.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 hornetq 2.3.20-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 hornetq-native +1 2.3.20-2.Final_redhat_1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 httpcomponents-eap6 +1 6-10.redhat_1.3.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 httpcore-eap6 +4 4.2.1-10.redhat_1.3.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 httpd +3 2.2.26-35.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 infinispan +4 5.2.10-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 ironjacamar-eap6 +9 1.0.26-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jandex-eap6 1.0.3-3.Final_redhat_2.2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jansi-eap6 1.9-2.redhat_4.3.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jaxbintros 1.0.2-17.GA_redhat_6.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jaxen-eap6 1.1.3-2.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-as-ee +50 7.4.0-13.Final_redhat_19.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-as-security +1 7.4.0-14.Final_redhat_19.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-genericjms 1.0.5-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-hal +1 2.2.8-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-jaxws-api_2.2_spec 2.0.2-4.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-jms-api_1.1_spec 1.0.1-8.Final_redhat_2.2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-jstl-api_1.2_spec 1.0.6-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-logging 3.1.4-1.GA_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-marshalling 1.4.6-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-metadata +5 7.1.0-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-msc 1.1.5-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-remoting3 3.3.1-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-saaj-api_1.3_spec 1.0.3-3.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-sasl 1.0.4-2.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-security-negotiation 2.3.3-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-transaction-api_1.1_spec 1.0.1-10.Final_redhat_2.2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-transaction-spi 7.1.0-2.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jboss-vfs2 3.2.5-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossas-core 7.4.0-16.Final_redhat_19.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossas-domain +4 7.4.0-15.Final_redhat_19.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossas-javadocs 7.4.0-20.Final_redhat_19.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossas-modules-eap 7.4.0-38.Final_redhat_19.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossas-product-eap 7.4.0-19.Final_redhat_19.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossas-welcome-content-eap 7.4.0-17.Final_redhat_19.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossts 1:4.17.21-2.Final_redhat_2.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossweb 7.4.8-4.Final_redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossws-common 2.3.0-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossws-cxf 4.3.0-3.Final_redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossws-native 4.2.0-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jbossws-spi 2.3.0-2.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jdom-eap6 1.1.2-6.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jettison-eap6 1.3.1-3.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jgroups 1:3.2.13-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 joda-time-eap6 1.6.2-1.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 jython-eap6 2.5.2-6.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 mod_cluster +1 1.2.9-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 mod_cluster-native 1.2.9-3.Final_redhat_2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 mod_jk +1 1.2.40-2.redhat_1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 mod_rt 2.4.1-3.GA.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 mod_snmp 2.4.1-7.GA.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 mod_ssl 1:2.2.26-35.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 netty 3.6.9-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 opensaml 2.5.3-4.redhat_2.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 openws 1.4.4-3.redhat_2.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 picketlink-bindings 2.5.3-8.SP10_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 picketlink-federation 2.5.3-9.SP10_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 resteasy 2.3.8-4.Final_redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 rngom-eap6 201103-2.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 scannotation 1.0.3-6.redhat_4.2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 slf4j +1 1.7.2-13.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 slf4j-jboss-logmanager 1.0.3-1.GA_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 snakeyaml-eap6 1.8-1.redhat_2.2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 stilts 0.1.26-13.redhat_4.2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 sun-codemodel 2.6-4.redhat_2.2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 sun-istack-commons 1:2.6.1-10.redhat_2.2.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 sun-saaj-1.3-impl 1.3.16-9.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 sun-txw2 20110809-7.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 sun-xsom 20110809-7.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 tomcat-native +1 1.1.30-2.redhat_1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 weld-core 1.1.23-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 woodstox-core-eap6 4.2.0-12.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 woodstox-stax2-api-eap6 3.1.3-3.redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 ws-commons-neethi 3.0.2-8.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 wsdl4j-eap6 1.6.3-1.redhat_1.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 xml-commons-resolver-eap6 1.2-17.redhat_9.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 xmltooling 1.3.4-6.redhat_3.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6 xom 1.2.7-3.redhat_4.1.ep6.el5 RHSA-2014:1020, RHSA-2014:1019

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 11 SP4 apache2 2.2.34-70.12.1 SUSE-SU-2017:2907-1
SLES 11 SP3 apache2 2.2.34-70.12.1 SUSE-SU-2017:2907-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Studio Onsite 1.3 apache2 2.2.34-70.12.1 SUSE-SU-2017:2907-1
SLES for SAP 11 SP4 apache2 2.2.34-70.12.1 SUSE-SU-2017:2907-1
SUSE Linux Enterprise Point of Sale 11 SP3 apache2 2.2.34-70.12.1 SUSE-SU-2017:2907-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apache2 2.4.23-4.1 openSUSE-SU-2024:10268-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 httpd +5 2.4.6-18.0.1.el7_0 ELSA-2014-0921
Oracle Linux 7 mod_ssl +1 1:2.4.6-18.0.1.el7_0 ELSA-2014-0921

Advisories 13

References