Bug 1103804 (CVE-2014-0095)

Summary: CVE-2014-0095 Apache Tomcat 8: Denial of service via AJP requests with content length zero
Product: [Other] Security Response Reporter: Arun Babu Neelicattu <aneelica>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aneelica, dknox, grocha, ivan.afonichev, java-sig-commits, jdoyle, jkurik, jrusnack, krzysztof.daniel, lgao, pslavice, rsvoboda, weli
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20140530,reported=20140530,source=internet,cvss2=5.0/AV:N/AC:L/Au:N/C:N/I:N/A:P,cwe=CWE-130->CWE-835,rhel-6/tomcat6=notaffected,rhel-5/tomcat5=notaffected,jbews-1/tomcat5=notaffected,jbews-1/tomcat6=notaffected,jbews-2/tomcat6=notaffected,jbews-2/tomcat7=notaffected,fedora-all/tomcat=notaffected,rhel-7/tomcat=notaffected,jboss/jbossweb=notaffected
Fixed In Version: tomcat 8.0.5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-02 15:31:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 1103878    

Description Arun Babu Neelicattu 2014-06-02 15:28:15 UTC
A regression was introduced in  revision 1519838 (released with Apache Tomcat 8.0.0-RC2) that caused AJP requests to hang if an explicit content length of zero was set on the request. The hanging request consumed a request processing thread which could lead to a denial of service.

Affects:
Apache Tomcat 8.0.0-RC2 to 8.0.3

References:
http://tomcat.apache.org/security-8.html

Comment 1 Arun Babu Neelicattu 2014-06-02 15:31:18 UTC
Statement:

This flaw does not affect Apache Tomcat as shipped by any Red Hat product as it was introduced in Apache Tomcat 8.0.0-RC2 and did not affect earlier versions.