tomcat6: CVE-2014-0227: HTTP request smuggling or DoS by streaming malformed data

Debian Bug report logs - #785312
tomcat6: CVE-2014-0227: HTTP request smuggling or DoS by streaming malformed data

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Santiago Ruano Rincón <santiagorr@riseup.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Cc: Debian LTS <debian-lts@lists.debian.org>

Subject: tomcat6: CVE-2014-0227: HTTP request smuggling or DoS by streaming malformed data

Date: Thu, 14 May 2015 16:48:23 +0200

[Message part 1 (text/plain, inline)]

Source: tomcat6
Version: 6.0.35-6+deb7u1
Severity: important
Tags: security patch upstream fixed-upstream

Hi there,

The following vulnerability affects current tomcat 6.x in squeeze and wheezy.

According to CVE-2014-0227 [cve], "Apache Tomcat 6.x before 6.0.42, 7.x before
7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue
reading data after an error has occurred, which allows remote attackers to
conduct HTTP request smuggling attacks or cause a denial of service (resource
consumption) by streaming data with malformed chunked transfer coding".

I have prepared the attached patch, based on [fix].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

[cve] https://security-tracker.debian.org/tracker/CVE-2014-0227 
[fix] https://svn.apache.org/viewvc?view=revision&revision=1603628

Please adjust the affected versions in the BTS as needed.

Cheers,

Santiago

[CVE-2014-0227.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.