CVE-2014-0050
Fixed in a distro release EPSS 83%CVSS 7.5
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Products: oracle retail_applications, apache commons_fileupload, apache tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | commons-fileupload:commons-fileupload | 1.3.1 |
| Maven | org.apache.tomcat:tomcat | 8.0.3 |
| Maven | org.apache.tomcat:tomcat | 7.0.52 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libcommons-fileupload-java | 1.3.1-1 |
| Debian 13 | libcommons-fileupload-java | 1.3.1-1 |
| Debian 14 | libcommons-fileupload-java | 1.3.1-1 |
| Debian 6.0 | libcommons-fileupload-java | 1.2.2-1+deb6u2 |
| Debian 7 | libcommons-fileupload-java | 1.2.2-1+deb7u2 |
| Debian 7 | tomcat7 | 7.0.28-4+deb7u1 |
| Red Hat Enterprise Linux 6 | tomcat6 | 0:6.0.24-64.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-admin-webapps | 0:6.0.24-64.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-docs-webapp | 0:6.0.24-64.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-el-2.1-api | 0:6.0.24-64.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-javadoc | 0:6.0.24-64.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-jsp-2.1-api | 0:6.0.24-64.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-lib | 0:6.0.24-64.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-servlet-2.5-api | 0:6.0.24-64.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-webapps | 0:6.0.24-64.el6_5 |
| Red Hat jboss enterprise application platform 6 | jbossweb | 0:7.3.0-2.Final_redhat_2.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossweb | 0:7.3.0-2.Final_redhat_2.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6 | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6 | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-admin-webapps | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-admin-webapps | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-docs-webapp | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-docs-webapp | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-el-2.1-api | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-el-2.1-api | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-javadoc | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-javadoc | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-jsp-2.1-api | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-jsp-2.1-api | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-lib | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-lib | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-log4j | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-log4j | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-servlet-2.5-api | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-servlet-2.5-api | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-webapps | 0:6.0.37-19_patch_04.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-webapps | 0:6.0.37-27_patch_04.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7 | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7 | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-admin-webapps | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-admin-webapps | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-docs-webapp | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-docs-webapp | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-el-2.2-api | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-el-2.2-api | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-javadoc | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-javadoc | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-jsp-2.2-api | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-jsp-2.2-api | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-lib | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-lib | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-log4j | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-log4j | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-servlet-3.0-api | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-servlet-3.0-api | 0:7.0.40-9_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-webapps | 0:7.0.40-13_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-webapps | 0:7.0.40-9_patch_02.ep6.el6 |
| openSUSE Tumbleweed | apache-commons-fileupload | 1.4-1.9 |
| openSUSE Tumbleweed | tomcat | 8.0.36-3.3 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 |