Bug 788606

Summary:	CVE-2011-5035 OpenJDK: HttpServer no header count limit (Lightweight HTTP Server, 7126960)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahughes, aph, chphilli, dbhole, ddadacha, jrusnack, jvanek, omajid, ptisnovs, rkennke, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-04-25 07:02:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	787142, 787143, 787144, 787145, 788202, 788203, 788204, 788205, 788206, 813689, 813690, 813691, 813692
Bug Blocks:	770929, 786724

Description Tomas Hoger 2012-02-08 15:20:54 UTC

It was discovered that HttpServer class did not limit the number of headers read from the HTTP request. An HTTP client could send a request with a large amount of headers and make HttpServer use an excessive amount CPU time by triggering collisions in the HashMap class (see bug #750533) used to store headers form a request.

The fix addresses the problem by adding a header count limit controlled using the sun.net.httpserver.maxReqHeaders properly with the default value of 200.

Comment 5 Vincent Danen 2012-02-14 23:07:42 UTC

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html

Comment 6 errata-xmlrpc 2012-02-14 23:42:49 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0135 https://rhn.redhat.com/errata/RHSA-2012-0135.html

Comment 7 Tomas Hoger 2012-02-15 08:45:49 UTC

Patches were applied in following IcedTea versions:

* IcedTea6 1.8.13 (based on OpenJDK6 b18)
* IcedTea6 1.9.13 (based on OpenJDK6 b20)
* IcedTea6 1.10.6 (based on OpenJDK6 b22)
* IcedTea6 1.11.1 (based on OpenJDK6 b24)
* IcedTea 2.0.1 (based on OpenJDK7 u1 + u3 security patches)

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-February/017249.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-February/017233.html

Patch:
http://icedtea.classpath.org/hg/release/icedtea6-1.10/file/4e7a700d4ecc/patches/security/20120214/7126960.patch

Comment 8 errata-xmlrpc 2012-02-16 19:01:48 UTC

This issue has been addressed in following products:

  Extras for RHEL 4
  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:0139 https://rhn.redhat.com/errata/RHSA-2012-0139.html

Comment 9 errata-xmlrpc 2012-02-21 21:58:28 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0322 https://rhn.redhat.com/errata/RHSA-2012-0322.html

Comment 10 errata-xmlrpc 2012-04-24 19:36:23 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:0514 https://rhn.redhat.com/errata/RHSA-2012-0514.html

Comment 11 errata-xmlrpc 2013-10-23 17:02:53 UTC

This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html