CVE-2014-0227

Aliases:GHSA-42j3-498q-m6vp
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 16 Feb 2015, 00:00
Last modified:06 Aug 2024, 09:05

Vulnerability Summary

Overall Risk (default)
medium
41/100
CVSS Score
6.4 MEDIUM
v2.0 (nvd)
EPSS Score
78.23% CRITICAL
78% probability -3.86%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

16 Feb 2015, 00:00
Published
Vulnerability first disclosed
06 Aug 2024, 09:05
Last Modified
Vulnerability information updated

Description

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

CVSS Metrics

  • v2.0•MEDIUM•Score: 6.4AV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS Trends

Current EPSS score: 78.23%• Percentile: 99%

Techniques & Countermeasures

  • CWE-19•Data Processing Errors

    Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Affected Systems

  • Unknown•Tomcat

    6.0.0 | 6.0.0:alpha | 6.0.1 | 6.0.1:alpha | 6.0.2 | 6.0.2:alpha | 6.0.2:beta | 6.0.3 | 6.0.4 | 6.0.4:alpha | 6.0.5 | 6.0.6 | 6.0.6:alpha | 6.0.7 | 6.0.7:alpha | 6.0.7:beta | 6.0.8 | 6.0.8:alpha | 6.0.9 | 6.0.9:beta | 6.0.10 | 6.0.11 | 6.0.12 | 6.0.13 | 6.0.14 | 6.0.15 | 6.0.16 | 6.0.17 | 6.0.18 | 6.0.19 | 6.0.20 | 6.0.24 | 6.0.26 | 6.0.27 | 6.0.28 | 6.0.29 | 6.0.30 | 6.0.31 | 6.0.32 | 6.0.33 | 6.0.35 | 6.0.36 | 6.0.37 | 6.0.39 | 6.0.41 | 7.0.0 | 7.0.0:beta | 7.0.1 | 7.0.2 | 7.0.2:beta | 7.0.3 | 7.0.4 | 7.0.4:beta | 7.0.5 | 7.0.6 | 7.0.7 | 7.0.8 | 7.0.9 | 7.0.10 | 7.0.11 | 7.0.12 | 7.0.13 | 7.0.14 | 7.0.15 | 7.0.16 | 7.0.17 | 7.0.18 | 7.0.19 | 7.0.20 | 7.0.21 | 7.0.22 | 7.0.23 | 7.0.24 | 7.0.25 | 7.0.26 | 7.0.27 | 7.0.28 | 7.0.29 | 7.0.30 | 7.0.31 | 7.0.32 | 7.0.33 | 7.0.34 | 7.0.35 | 7.0.36 | 7.0.37 | 7.0.38 | 7.0.39 | 7.0.40 | 7.0.41 | 7.0.42 | 7.0.43 | 7.0.44 | 7.0.45 | 7.0.46 | 7.0.47 | 7.0.48 | 7.0.49 | 7.0.50 | 7.0.52 | 7.0.53 | 7.0.54 | 8.0.0:rc1 | 8.0.0:rc10 | 8.0.0:rc2 | 8.0.0:rc5 | 8.0.1 | 8.0.3 | 8.0.5 | 8.0.8

  • org.apache.tomcat•tomcat

    ≥ 6.0.0, < 6.0.42 | ≥ 7.0.0, < 7.0.55 | ≥ 8.0.0, < 8.0.9

References (45)