what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from AntBean

Apache Tomcat Connection Swallow Denial Of Service

Posted May 6, 2015

Authored by AntBean | Site tomcat.apache.org

When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited denial of service as Tomcat would never close the connection and a processing thread would remain allocated to the connection. Versions affected include Apache Tomcat 8.0.0-RC1 to 8.0.8, 7.0.0 to 7.0.54, and 6.0.0 to 6.0.43.

tags | advisory, denial of service

advisories | CVE-2014-0230

SHA-256 | 1ad1eefef30402ac2fe3a0012efc3d875f14db6ddf39ce0f35dd36949d4a85ea

Download | Favorite | View