Bug 1103804 (CVE-2014-0095)

Summary: CVE-2014-0095 Apache Tomcat 8: Denial of service via AJP requests with content length zero
Product: [Other] Security Response Reporter: Arun Babu Neelicattu <aneelica>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aneelica, dknox, grocha, ivan.afonichev, java-sig-commits, jdoyle, jkurik, jrusnack, krzysztof.daniel, lgao, pslavice, rsvoboda, weli
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: tomcat 8.0.5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-02 15:31:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1103878    

Description Arun Babu Neelicattu 2014-06-02 15:28:15 UTC 
A regression was introduced in  revision 1519838 (released with Apache Tomcat 8.0.0-RC2) that caused AJP requests to hang if an explicit content length of zero was set on the request. The hanging request consumed a request processing thread which could lead to a denial of service.

Affects:
Apache Tomcat 8.0.0-RC2 to 8.0.3

References:
http://tomcat.apache.org/security-8.html
Comment 1 Arun Babu Neelicattu 2014-06-02 15:31:18 UTC 
Statement:

This flaw does not affect Apache Tomcat as shipped by any Red Hat product as it was introduced in Apache Tomcat 8.0.0-RC2 and did not affect earlier versions.