CVE-2014-0227
Vulnerability Summary
Timeline
Description
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
CVSS Metrics
- v2.0•MEDIUM•Score: 6.4AV:N/AC:L/Au:N/C:N/I:P/A:P
EPSS Trends
Current EPSS score: 21.04%• Percentile: 97%
Techniques & Countermeasures
- CWE-19•Data Processing Errors
Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Affected Systems
- apache•tomcat
6.0.0 | 6.0.0:alpha | 6.0.1 | 6.0.1:alpha | 6.0.2 | 6.0.2:alpha | 6.0.2:beta | 6.0.3 | 6.0.4 | 6.0.4:alpha | 6.0.5 | 6.0.6 | 6.0.6:alpha | 6.0.7 | 6.0.7:alpha | 6.0.7:beta | 6.0.8 | 6.0.8:alpha | 6.0.9 | 6.0.9:beta | 6.0.10 | 6.0.11 | 6.0.12 | 6.0.13 | 6.0.14 | 6.0.15 | 6.0.16 | 6.0.17 | 6.0.18 | 6.0.19 | 6.0.20 | 6.0.24 | 6.0.26 | 6.0.27 | 6.0.28 | 6.0.29 | 6.0.30 | 6.0.31 | 6.0.32 | 6.0.33 | 6.0.35 | 6.0.36 | 6.0.37 | 6.0.39 | 6.0.41 | 7.0.0 | 7.0.0:beta | 7.0.1 | 7.0.2 | 7.0.2:beta | 7.0.3 | 7.0.4 | 7.0.4:beta | 7.0.5 | 7.0.6 | 7.0.7 | 7.0.8 | 7.0.9 | 7.0.10 | 7.0.11 | 7.0.12 | 7.0.13 | 7.0.14 | 7.0.15 | 7.0.16 | 7.0.17 | 7.0.18 | 7.0.19 | 7.0.20 | 7.0.21 | 7.0.22 | 7.0.23 | 7.0.24 | 7.0.25 | 7.0.26 | 7.0.27 | 7.0.28 | 7.0.29 | 7.0.30 | 7.0.31 | 7.0.32 | 7.0.33 | 7.0.34 | 7.0.35 | 7.0.36 | 7.0.37 | 7.0.38 | 7.0.39 | 7.0.40 | 7.0.41 | 7.0.42 | 7.0.43 | 7.0.44 | 7.0.45 | 7.0.46 | 7.0.47 | 7.0.48 | 7.0.49 | 7.0.50 | 7.0.52 | 7.0.53 | 7.0.54 | 8.0.0:rc1 | 8.0.0:rc10 | 8.0.0:rc2 | 8.0.0:rc5 | 8.0.1 | 8.0.3 | 8.0.5 | 8.0.8
- org.apache.tomcat•tomcat
≥ 6.0.0, < 6.0.42 | ≥ 7.0.0, < 7.0.55 | ≥ 8.0.0, < 8.0.9
- redhat•tomcat
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-admin-webapps
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-docs-webapp
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.ael7b_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-el-2.2-api
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-javadoc
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.ael7b_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-jsp-2.2-api
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-jsvc
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.ael7b_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-lib
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-servlet-3.0-api
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.ael7b_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat-webapps
< 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1 | < 0:7.0.54-2.el7_1
- redhat•tomcat6
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-admin-webapps
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-debuginfo
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-docs-webapp
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-el-2.1-api
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-javadoc
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-jsp-2.1-api
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-lib
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-servlet-2.5-api
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
- redhat•tomcat6-webapps
< 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6 | < 0:6.0.24-83.el6_6
References (54)
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.ubuntu.com/usn/USN-2654-1
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:052
- http://marc.info/?l=bugtraq&m=143393515412274&w=2
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://www.securityfocus.com/bid/72717
- http://rhn.redhat.com/errata/RHSA-2015-0991.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
- http://www.debian.org/security/2016/dsa-3530
- http://www.securitytracker.com/id/1032791
- http://tomcat.apache.org/security-7.html
- http://rhn.redhat.com/errata/RHSA-2015-0983.html
- http://marc.info/?l=bugtraq&m=143403519711434&w=2
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:053
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
- http://tomcat.apache.org/security-8.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1109196
- https://source.jboss.org/changelog/JBossWeb?cs=2455
- http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html
- http://advisories.mageia.org/MGASA-2015-0081.html
- http://tomcat.apache.org/security-6.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.ubuntu.com/usn/USN-2655-1
- http://svn.apache.org/viewvc?view=revision&revision=1600984
- http://www.debian.org/security/2016/dsa-3447
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2014-0227
- https://github.com/apache/tomcat/commit/593a2447e6ebe465585cfa07e93b5635dffa1c70
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://access.redhat.com/errata/RHSA-2015:0983
- https://access.redhat.com/security/updates/classification/#moderate
- https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55
- https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0983.json
- https://access.redhat.com/security/cve/CVE-2014-0227
- https://www.cve.org/CVERecord?id=CVE-2014-0227
- https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.43
- https://access.redhat.com/errata/RHSA-2015:0991
- https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0991.json