CVE-2014-0099
published 2014-05-31CVE-2014-0099: Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a…
PriorityP430medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
8.84%
94.7th percentile
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
Affected
92 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | <= 6.0.39 | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_ubuntu5.0MEDIUM
vendor_apache4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2014-07-30·CVSS 5.0
CVE-2014-0075 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
David Jorm discovered that Tomcat incorrectly handled certain requests
submitted using chunked transfer encoding. A remote attacker could use this
flaw to cause the Tomcat server to consume resources, resulting in a denial
of service. (CVE-2014-0075)
It was discovered that Tomcat did not properly restrict XSLT stylesheets.
An attacker could use this issue with a crafted web application to bypass
security-manager restrictions and read arbitrary files. (CVE-2014-0096)
It was discovered that Tomcat incorrectly handled certain Content-Length
headers. A remote attacker could use this flaw in configurations where
Tomcat is behind a reverse proxy to perform HTTP request smuggling attacks.
(CVE-2014-0099)
Ins
Red Hat
Tomcat/JBossWeb: Request smuggling via malicious content length header
vendor_redhat·2014-05-27·CVSS 4.3
CVE-2014-0099 [MEDIUM] CWE-190 Tomcat/JBossWeb: Request smuggling via malicious content length header
Tomcat/JBossWeb: Request smuggling via malicious content length header
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.
Statement: This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat P
Apache
Apache tomcat: CVE-2014-0099
vendor_apache·CVSS 4.3
CVE-2014-0099 [MEDIUM] Apache tomcat: CVE-2014-0099
Apache tomcat: CVE-2014-0099
The code used to parse the request content length header did not check for overflow in the result. This exposed a request smuggling vulnerability when Tomcat was located behind a reverse proxy that correctly processed the content length header. This was fixed in revision 1578812 . A test case that demonstrated the parsing bug was sent to the Tomcat security team on 13 March 2014 but no context was provided. The security implications were identified by the Tomcat security team the day the report was received and made public on 27 May 2014. Affects: 8.0.0-RC1 to 8.0.3 beta, 11 Feb 2014 Fixed in Apache Tomcat 8.0.3 Note: The issue below was fixed in Apache Tomcat 8.0.2 but the release vote for the 8.0.2 release candidates did not pass. Therefore, although users mu
OSV
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
osv·2022-05-14
CVE-2014-0099 [MEDIUM] Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
GHSA
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
ghsa·2022-05-14
CVE-2014-0099 [MEDIUM] CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
OSV
tomcat6, tomcat7 vulnerabilities
osv·2014-07-30·CVSS 5.0
CVE-2014-0075 [MEDIUM] tomcat6, tomcat7 vulnerabilities
tomcat6, tomcat7 vulnerabilities
David Jorm discovered that Tomcat incorrectly handled certain requests
submitted using chunked transfer encoding. A remote attacker could use this
flaw to cause the Tomcat server to consume resources, resulting in a denial
of service. (CVE-2014-0075)
It was discovered that Tomcat did not properly restrict XSLT stylesheets.
An attacker could use this issue with a crafted web application to bypass
security-manager restrictions and read arbitrary files. (CVE-2014-0096)
It was discovered that Tomcat incorrectly handled certain Content-Length
headers. A remote attacker could use this flaw in configurations where
Tomcat is behind a reverse proxy to perform HTTP request smuggling attacks.
(CVE-2014-0099)
OSV
CVE-2014-0099: Integer overflow in java/org/apache/tomcat/util/buf/Ascii
osv·2014-05-31·CVSS 4.3
CVE-2014-0099 [MEDIUM] CVE-2014-0099: Integer overflow in java/org/apache/tomcat/util/buf/Ascii
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0099 Apache Tomcat: Request smuggling via malicious content length header [fedora-all]
bugzilla·2014-05-28·CVSS 4.3
CVE-2014-0099 [MEDIUM] CVE-2014-0099 Apache Tomcat: Request smuggling via malicious content length header [fedora-all]
CVE-2014-0099 Apache Tomcat: Request smuggling via malicious content length header [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue
Bugzilla
CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header
bugzilla·2014-05-28·CVSS 4.3
CVE-2014-0099 [MEDIUM] CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header
CVE-2014-0099 Tomcat/JBossWeb: Request smuggling via malicious content length header
It was found that the code used to parse the request content length header did not check for overflow in the result. This exposed a request smuggling vulnerability when Tomcat was located behind a reverse proxy that correctly processed the content length header.
Discussion:
Created tomcat tracking bugs for this issue:
Affects: fedora-all [bug 1102210]
---
Tomcat 6 fix: http://svn.apache.org/viewvc?view=revision&revision=1580473
Tomcat 7 fix: http://svn.apache.org/viewvc?view=revision&revision=1578814
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 7
Via RHSA-2014:0827 https://rhn.redhat.com/errata/RHSA-2014-0827.html
---
This issue has been addressed in follow
arXiv
SeqTrans: Automatic Vulnerability Fix via Sequence to Sequence Learning
arxiv_fulltext·2022-03-22
SeqTrans: Automatic Vulnerability Fix via Sequence to Sequence Learning
SeqTrans: Automatic Vulnerability Fix via Sequence to Sequence Learning
Jianlei Chi,
Yu Qu,
Ting Liu, Member, IEEE,
Qinghua Zheng, Member, IEEE,
Heng Yin, Member, IEEE
J. Chi, T. Liu and Q. Zheng are with the Ministry of Education Key Lab For Intelligent Networks and Network Security (MOEKLINNS), School of Computer Science and Technology, Xian Jiaotong University, Xian 710049, China.
Email: [email protected], tliu, [email protected].
Y. Qu and H. Yin are with the Department of Computer Science and Engineering, UC Riverside, California, USA.
\ : [email protected], [email protected]
Journal of \ Class Files, Vol. 14, No. 8, May 2021
Shell et al.: Bare Advanced Demo of IEEEtran.cls for IEEE Computer Society Journals
## Abstract
Software vulnerabilities are now reported unprecedented
http://advisories.mageia.org/MGASA-2014-0268.htmlhttp://linux.oracle.com/errata/ELSA-2014-0865.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.htmlhttp://marc.info/?l=bugtraq&m=141017844705317&w=2http://marc.info/?l=bugtraq&m=141390017113542&w=2http://marc.info/?l=bugtraq&m=144498216801440&w=2http://rhn.redhat.com/errata/RHSA-2015-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0720.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0765.htmlhttp://seclists.org/fulldisclosure/2014/Dec/23http://seclists.org/fulldisclosure/2014/May/138http://seclists.org/fulldisclosure/2014/May/140http://secunia.com/advisories/59121http://secunia.com/advisories/59678http://secunia.com/advisories/59732http://secunia.com/advisories/59835http://secunia.com/advisories/59849http://secunia.com/advisories/59873http://secunia.com/advisories/60729http://secunia.com/advisories/60793http://svn.apache.org/viewvc?view=revision&revision=1578812http://svn.apache.org/viewvc?view=revision&revision=1578814http://svn.apache.org/viewvc?view=revision&revision=1580473http://tomcat.apache.org/security-6.htmlhttp://tomcat.apache.org/security-7.htmlhttp://tomcat.apache.org/security-8.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21678231http://www-01.ibm.com/support/docview.wss?uid=swg21680603http://www-01.ibm.com/support/docview.wss?uid=swg21681528http://www.debian.org/security/2016/dsa-3447http://www.debian.org/security/2016/dsa-3530http://www.mandriva.com/security/advisories?name=MDVSA-2015:052http://www.mandriva.com/security/advisories?name=MDVSA-2015:053http://www.mandriva.com/security/advisories?name=MDVSA-2015:084http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlhttp://www.securityfocus.com/archive/1/532218/100/0/threadedhttp://www.securityfocus.com/archive/1/532221/100/0/threadedhttp://www.securityfocus.com/archive/1/534161/100/0/threadedhttp://www.securityfocus.com/bid/67668http://www.securitytracker.com/id/1030302http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3Ehttp://advisories.mageia.org/MGASA-2014-0268.htmlhttp://linux.oracle.com/errata/ELSA-2014-0865.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.htmlhttp://marc.info/?l=bugtraq&m=141017844705317&w=2http://marc.info/?l=bugtraq&m=141390017113542&w=2http://marc.info/?l=bugtraq&m=144498216801440&w=2http://rhn.redhat.com/errata/RHSA-2015-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0720.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0765.htmlhttp://seclists.org/fulldisclosure/2014/Dec/23http://seclists.org/fulldisclosure/2014/May/138http://seclists.org/fulldisclosure/2014/May/140http://secunia.com/advisories/59121http://secunia.com/advisories/59678http://secunia.com/advisories/59732http://secunia.com/advisories/59835http://secunia.com/advisories/59849http://secunia.com/advisories/59873http://secunia.com/advisories/60729http://secunia.com/advisories/60793http://svn.apache.org/viewvc?view=revision&revision=1578812http://svn.apache.org/viewvc?view=revision&revision=1578814http://svn.apache.org/viewvc?view=revision&revision=1580473http://tomcat.apache.org/security-6.htmlhttp://tomcat.apache.org/security-7.htmlhttp://tomcat.apache.org/security-8.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21678231http://www-01.ibm.com/support/docview.wss?uid=swg21680603http://www-01.ibm.com/support/docview.wss?uid=swg21681528http://www.debian.org/security/2016/dsa-3447http://www.debian.org/security/2016/dsa-3530http://www.mandriva.com/security/advisories?name=MDVSA-2015:052http://www.mandriva.com/security/advisories?name=MDVSA-2015:053http://www.mandriva.com/security/advisories?name=MDVSA-2015:084http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlhttp://www.securityfocus.com/archive/1/532218/100/0/threadedhttp://www.securityfocus.com/archive/1/532221/100/0/threadedhttp://www.securityfocus.com/archive/1/534161/100/0/threadedhttp://www.securityfocus.com/bid/67668http://www.securitytracker.com/id/1030302http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
2014-05-31
Published