CVE-2014-0227
Publication date 15 February 2015
Last updated 24 July 2024
Ubuntu priority
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
From the Ubuntu Security Team
It was discovered that Tomcat incorrectly handled data with malformed chunked transfer coding. A remote attacker could possibly use this issue to conduct HTTP request smuggling attacks, or cause Tomcat to consume resources, resulting in a denial of service.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| tomcat6 | 18.04 LTS bionic | Not in release |
| 16.04 LTS xenial |
Fixed 6.0.45+dfsg-1
|
|
| 14.04 LTS trusty |
Fixed 6.0.39-1ubuntu0.1
|
|
| tomcat7 | 18.04 LTS bionic |
Not affected
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Fixed 7.0.52-1ubuntu0.3
|
|
| tomcat8 | 18.04 LTS bionic |
Not affected
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Not in release | |
Patch details
| Package | Patch details |
|---|---|
| tomcat6 | |
| tomcat7 | |
| tomcat8 |
References
Related Ubuntu Security Notices (USN)
- USN-2655-1
- Tomcat vulnerabilities
- 25 June 2015
- USN-2654-1
- Tomcat vulnerabilities
- 25 June 2015