It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat and JBoss Web processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default.
Find out more about CVE-2013-4322 from the MITRE CVE dictionary dictionary and NIST NVD.
| Base Score | 4.3 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:N/I:N/A:P |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | None |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server (tomcat7) | RHSA-2014:0526 | 2014-05-21 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server (tomcat6) | RHSA-2014:0525 | 2014-05-21 |
| Red Hat Enterprise Linux 6 (tomcat6) | RHSA-2014:0429 | 2014-04-23 |
| Red Hat Enterprise Linux 7 (tomcat) | RHSA-2014:0686 | 2014-06-10 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server (tomcat7) | RHSA-2014:0526 | 2014-05-21 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server (tomcat6) | RHSA-2014:0525 | 2014-05-21 |
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss Portal Platform 6 | jbossweb | Not affected |
| Red Hat JBoss Operations Network 3 | jbossweb | Not affected |
| Red Hat JBoss Fuse Service Works 6 | jbossweb | Not affected |
| Red Hat JBoss EWS 1 | tomcat6 | Will not fix |
| Red Hat JBoss EWS 1 | tomcat5 | Will not fix |
| Red Hat JBoss EAP 6 | jbossweb | Not affected |
| Red Hat JBoss EAP 5 | jbossweb | Not affected |
| Red Hat JBoss Data Virtualization 6 | jbossweb | Not affected |
| Red Hat JBoss Data Grid 6 | jbossweb | Not affected |
| Red Hat JBoss BRMS 6 | jbossweb | Not affected |
| Red Hat JBoss BPMS 6 | jbossweb | Not affected |
| Red Hat Enterprise Linux 5 | tomcat5 | Will not fix |
Vulmon