CVE-2014-0230: non-persistent DoS attack by feeding data aborting an upload

Related Vulnerabilities: CVE-2014-0230  

Debian Bug report logs - #785316
CVE-2014-0230: non-persistent DoS attack by feeding data aborting an upload

version graph

Reported by: Santiago Ruano Rincón <santiagorr@riseup.net>

Date: Thu, 14 May 2015 15:18:02 UTC

Severity: normal

Tags: fixed-upstream, security, upstream

Found in version tomcat6/6.0.41-2+squeeze6

Fixed in versions tomcat6/6.0.45+dfsg-1~deb7u1, tomcat6/6.0.45+dfsg-1, tomcat6/6.0.45+dfsg-1~deb8u1

Done: Emmanuel Bourg <ebourg@apache.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>:
Bug#785316; Package src:tomcat6. (Thu, 14 May 2015 15:18:07 GMT) (full text, mbox, link).


Acknowledgement sent to Santiago Ruano Rincón <santiagorr@riseup.net>:
New Bug report received and forwarded. Copy sent to Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>. (Thu, 14 May 2015 15:18:07 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Santiago Ruano Rincón <santiagorr@riseup.net>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Cc: Debian LTS <debian-lts@lists.debian.org>
Subject: CVE-2014-0230: non-persistent DoS attack by feeding data aborting an upload
Date: Thu, 14 May 2015 17:15:42 +0200
[Message part 1 (text/plain, inline)]
Source: tomcat6
Version: 6.0.41-2+squeeze6
Severity: normal
Tags: security upstream fixed-upstream

Hello,

The following vulnerability affects tomcat6 in squeeze and wheezy.

CVE-2014-0230 [cve]: Tomcat permits a limited Denial of Service.

I have prepared the attached patch for the 6.0.41-2+squeeze6 version,
based on [fix].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

[cve] https://security-tracker.debian.org/tracker/CVE-2014-0230
[fix] https://svn.apache.org/viewvc?view=revision&revision=1659537

Please adjust the affected versions in the BTS as needed.

Regards,

Santiago
[CVE-2014-0230.patch (text/x-diff, attachment)]
[signature.asc (application/pgp-signature, inline)]

Marked as fixed in versions tomcat6/6.0.45+dfsg-1~deb7u1. Request was from Emmanuel Bourg <ebourg@apache.org> to control@bugs.debian.org. (Thu, 21 Jul 2016 10:36:06 GMT) (full text, mbox, link).


Marked as fixed in versions tomcat6/6.0.45+dfsg-1~deb8u1. Request was from Emmanuel Bourg <ebourg@apache.org> to control@bugs.debian.org. (Thu, 21 Jul 2016 10:36:09 GMT) (full text, mbox, link).


Marked as fixed in versions tomcat6/6.0.45+dfsg-1. Request was from Emmanuel Bourg <ebourg@apache.org> to control@bugs.debian.org. (Thu, 21 Jul 2016 10:36:13 GMT) (full text, mbox, link).


Marked Bug as done Request was from Emmanuel Bourg <ebourg@apache.org> to control@bugs.debian.org. (Thu, 21 Jul 2016 10:36:16 GMT) (full text, mbox, link).


Notification sent to Santiago Ruano Rincón <santiagorr@riseup.net>:
Bug acknowledged by developer. (Thu, 21 Jul 2016 10:36:17 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Fri, 19 Aug 2016 07:26:46 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 14:36:18 2019; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.