PT-2003-1330 · Apache · Jakarta Tomcat+1

Publicado 2003-02-07 · Atualizado 2022-04-29 · CVE-2003-0045

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Jakarta Tomcat versions prior to 3.3.1a

Description The issue allows remote attackers to cause a denial of service, resulting in thread hang and resource consumption. This occurs when a request is made for a JSP page containing an MS-DOS device name, such as aux.jsp. A sequence of such requests may cause all request processing threads to become unresponsive, leading to Tomcat becoming unresponsive.

Recommendations For Jakarta Tomcat versions prior to 3.3.1a, update to version 3.3.1a or later to resolve the issue. As a temporary workaround, consider restricting access to JSP pages that match Windows DOS device names to minimize the risk of exploitation.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2003-0045

GHSA-W97X-XFXF-F9XJ

Produtos afetados

Apache Tomcat

Jakarta Tomcat

Referências · 6

• https://osv.dev/vulnerability/GHSA-w97x-xfxf-f9xj · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0045 · Nota
• https://tomcat.apache.org/security-3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0045 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12102 · Nota
• http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt · Aviso do Fabricante