CVE-2014-0230

CVE-2014-0230

High · published June 8, 2015

CVSS v2.0
7.8
EPSS
20%
Percentile
97.5
In the wild
Unconfirmed
What it is

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.

The record
Technical detail
CVSS v2.0
7.8 · HIGH
Vector
AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS v4.0
Not supplied
EPSS
0.20183 · 97.5th percentile
Published
2015-06-08T03:59Z
Affected products (114)
ProductVersionsFixed in
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
oracle/virtualizationall versions—
oracle/virtualizationall versions—
oracle/virtualizationall versions—
References (78)
http://mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949D1.8030904%40apache.org%3E · [email protected]http://marc.info/?l=bugtraq&m=144498216801440&w=2 · [email protected]http://marc.info/?l=bugtraq&m=145974991225029&w=2 · [email protected]http://openwall.com/lists/oss-security/2015/04/10/1 · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1621.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-1622.html · [email protected]http://rhn.redhat.com/errata/RHSA-2015-2661.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-0595.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-0596.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-0597.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-0598.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-0599.html · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1603770 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1603775 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1603779 · [email protected]http://tomcat.apache.org/security-6.html · [email protected]http://tomcat.apache.org/security-7.html · [email protected]http://tomcat.apache.org/security-8.html · [email protected]http://www.debian.org/security/2016/dsa-3447 · [email protected]http://www.debian.org/security/2016/dsa-3530 · [email protected]http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · [email protected]http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html · [email protected]http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html · [email protected]http://www.securityfocus.com/bid/74475 · [email protected]http://www.ubuntu.com/usn/USN-2654-1 · [email protected]http://www.ubuntu.com/usn/USN-2655-1 · [email protected]https://access.redhat.com/errata/RHSA-2015:2659 · [email protected]https://access.redhat.com/errata/RHSA-2015:2660 · [email protected]https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964 · [email protected]https://issues.jboss.org/browse/JWS-219 · [email protected]https://issues.jboss.org/browse/JWS-220 · [email protected]https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · [email protected]http://mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949D1.8030904%40apache.org%3E · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=144498216801440&w=2 · af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=145974991225029&w=2 · af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2015/04/10/1 · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1621.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1622.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2661.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0595.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0596.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0597.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0598.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0599.html · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1603770 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1603775 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1603779 · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-6.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-7.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-8.html · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3447 · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3530 · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/74475 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2654-1 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2655-1 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2015:2659 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2015:2660 · af854a3a-2127-422b-91ae-364da2661108https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964 · af854a3a-2127-422b-91ae-364da2661108https://issues.jboss.org/browse/JWS-219 · af854a3a-2127-422b-91ae-364da2661108https://issues.jboss.org/browse/JWS-220 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 07 JUN 23:00Z
    Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the…
    cvelistv5