Published: 17/02/2017 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

It exists that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (prior to 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 12.04
debian debian linux 8.0
canonical ubuntu linux 14.04

Debian Bug report logs - #851304 tomcat8 use 100% cpu time Package: tomcat8; Maintainer for tomcat8 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for tomcat8 is src:tomcat8 (PTS, buildd, popcon) Reported by: RickLinux <linuxtr3@gmailcom> Date: Fri, 13 Jan 2017 20:21:02 UTC Severi ...

Tomcat could be made to consume resources if it received specially crafted network traffic ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6414 update on RHEL 7 Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for RHEL 7Red Hat Product Security has rated this update as having a security impact of ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application PlatformRed Hat Product Security has rated this update as having a security impact of Important A Common Vu ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6414 update on RHEL 6 Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for RHEL 6Red Hat Product Security has rated this update as having a security impact of ...

Synopsis Important: Red Hat JBoss Enterprise Application Platform 6414 update on RHEL 5 Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Application Platform 64 for RHEL 5Red Hat Product Security has rated this update as having a security impact of ...

Synopsis Important: jboss-ec2-eap security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 64 for RHEL 6Red Hat Product Security has rated this update as having a security impac ...

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop For the stable distribution (jessie), this problem has been fixed in version 8014-1+deb8u7 For the unstable distribution (sid), this problem will be fixed soon We recomm ...

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop For the stable distribution (jessie), this problem has been fixed in version 7056-3+deb8u8 We recommend that you upgrade your tomcat7 packages ...

CWE-835 https://lists.debian.org/debian-security-announce/2017/msg00039.html https://lists.debian.org/debian-security-announce/2017/msg00038.html https://bz.apache.org/bugzilla/show_bug.cgi?id=60578 https://bugs.debian.org/851304 http://www.securityfocus.com/bid/96293 http://www.securitytracker.com/id/1037860 http://www.debian.org/security/2017/dsa-3788 http://www.debian.org/security/2017/dsa-3787 http://rhn.redhat.com/errata/RHSA-2017-0829.html http://rhn.redhat.com/errata/RHSA-2017-0828.html http://rhn.redhat.com/errata/RHSA-2017-0827.html http://rhn.redhat.com/errata/RHSA-2017-0826.html http://rhn.redhat.com/errata/RHSA-2017-0517.html https://security.netapp.com/advisory/ntap-20180731-0002/https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851304 https://usn.ubuntu.com/3204-1/https://nvd.nist.gov

Get Started

CVE-2017-6056

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect