PT-2013-4956 · Apache+4 · Apache Tomcat+4

Published 2013-12-26 · Updated 2022-05-14 · CVE-2013-4322

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.0 through 6.0.38 Apache Tomcat versions 7.0.0 through 7.0.49 Apache Tomcat versions 8.0.0-RC1 through 8.0.0-RC9

Description The issue allows remote attackers to cause a denial of service by streaming data, due to improper handling of chunked transfer coding. This includes handling a large total amount of chunked data or whitespace characters in an HTTP header value within a trailer field. The estimated number of potentially affected devices is not provided.

Recommendations For Apache Tomcat versions 6.0.0 through 6.0.38, update to version 6.0.39 or later. For Apache Tomcat versions 7.0.0 through 7.0.49, update to version 7.0.50 or later. For Apache Tomcat versions 8.0.0-RC1 through 8.0.0-RC9, update to version 8.0.0-RC10 or later.

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CESA-2014_0429

CVE-2013-4322

DLA-91-1

DSA-2897-1

DSA-3530-1

GHSA-WQ2P-Q66W-Q8GP

MGASA-2014-0148

MGASA-2014-0149

RHSA-2014:0429

RHSA-2014:0525

RHSA-2014:0526

RHSA-2014:0686

RHSA-2014_0429

RHSA-2014_0686

USN-2130-1

Affected Products

Apache Tomcat

Centos

Red Hat

Suse

Vmware Vcenter

References · 79

• https://nvd.nist.gov/vuln/detail/CVE-2013-4322 · Security Note
• http://ubuntu.com/usn/USN-2130-1 · Vendor Advisory
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0429.html · Vendor Advisory
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:052 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0686.html · Vendor Advisory
• http://tomcat.apache.org/security-8.html · Vendor Advisory
• http://debian.org/security/2016/dsa-3530 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2014-0686.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4322 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4322 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0148 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:084 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3530-1 · Vendor Advisory