Bug 1422148 (CVE-2017-6056)
| Summary: | CVE-2017-6056 tomcat: Infinite loop in the processing of https requests | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | alee, bbaranow, bmaxwell, cdewolf, coolsvap, csutherl, dandread, darran.lofthouse, dosoudil, gzaronik, hhorak, ivan.afonichev, java-sig-commits, jawilson, jclere, jdoyle, jorton, jshepherd, krzysztof.daniel, lgao, mbabacek, mizdebsk, myarboro, pslavice, psotirop, rmaucher, rnetuka, rsvoboda, theute, twalsh, vondruch, vtunka, weli, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | tomcat 8.0.19, tomcat 7.0.60, tomcat 6.0.44 | Doc Type: | If docs needed, set a value |
| Doc Text: |
It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-21 11:51:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1423440, 1423452, 1423453, 1430252 | ||
| Bug Blocks: | 1422150, 1428993 | ||
|
Description
Andrej Nemec
2017-02-14 15:24:57 UTC
External References: http://tomcat.apache.org/security-7.html https://access.redhat.com/articles/2991951 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4.14 Via RHSA-2017:0517 https://rhn.redhat.com/errata/RHSA-2017-0517.html This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Via RHSA-2017:0828 https://rhn.redhat.com/errata/RHSA-2017-0828.html This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Via RHSA-2017:0827 https://rhn.redhat.com/errata/RHSA-2017-0827.html This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Via RHSA-2017:0826 https://rhn.redhat.com/errata/RHSA-2017-0826.html This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Via RHSA-2017:0829 https://rhn.redhat.com/errata/RHSA-2017-0829.html Upstream commits for 6.0 and 7.0: https://github.com/apache/tomcat60/commit/a7a913dd6c88342d36bbac800056cb6c9376e293 https://github.com/apache/tomcat70/commit/6bd022b904429148610b9fb4cdc8082f20a93ccb Statement: This issue was made easier to exploit, causing a denial of service when the patch for CVE-2016-6816 was present and the patch that corrected this flaw was not. The issue was not classified as a security flaw upstream. It was corrected in products like Red Hat Enterprise Linux 6 and 7 and JBoss Enterprise Web Server 3 prior to the fix for CVE-2016-6816 being applied. This was not the case for JBoss Enterprise Application Server 6. As a result, only EAP 6.4.13 is vulnerable to this issue and 6.4.14 corrects it. For further information, refer to https://access.redhat.com/articles/2991951 |