Hide Forgot
The Tomcat fix for CVE-2005-2090 was not complete. It did not cover the following cases: - content-length header with chunked encoding over any HTTP connector - multiple content-length headers over any AJP connector Requests with multiple content-length headers or with a content-length header when chunked encoding is being used should be rejected as invalid. When multiple components (firewalls, caches, proxies and Tomcat) process a sequence of requests where one or more requests contain either multiple content-length headers or a content-length header when chunked encoding is being used and several components do not reject the request and make different decisions as to which content-length header to use an attacker can poison a web-cache, perform an XSS attack and obtain sensitive information from requests other then their own. Tomcat now rejects requests with multiple content-length headers or with a content-length header when chunked encoding is being used. This has been corrected in upstream versions 8.0.0-rc3 [1], 7.0.47 [2], and 6.0.39 [3]. [1] http://svn.apache.org/viewvc?view=revision&revision=1521829 [2] http://svn.apache.org/viewvc?view=revision&revision=1521854 [3] http://svn.apache.org/viewvc?view=revision&revision=1552565
Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1069925]
This issue has been addressed in following products: Red Hat JBoss Enterprise Application Platform 6.2.2 Via RHSA-2014:0345 https://rhn.redhat.com/errata/RHSA-2014-0345.html
This issue has been addressed in following products: JBEAP 6.2 for RHEL 5 JBEAP 6 for RHEL 5 Via RHSA-2014:0343 https://rhn.redhat.com/errata/RHSA-2014-0343.html
This issue has been addressed in following products: JBEAP 6.2 for RHEL 6 JBEAP 6 for RHEL 6 Via RHSA-2014:0344 https://rhn.redhat.com/errata/RHSA-2014-0344.html
This issue has been addressed in following products: Red Hat JBoss BRMS 6.0.1 Red Hat JBoss BPM Suite 6.0.1 Via RHSA-2014:0373 https://rhn.redhat.com/errata/RHSA-2014-0373.html
This issue has been addressed in following products: Red Hat JBoss Data Grid 6.2.1 Via RHSA-2014:0374 https://rhn.redhat.com/errata/RHSA-2014-0374.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0429 https://rhn.redhat.com/errata/RHSA-2014-0429.html
This issue has been addressed in following products: Red Hat JBoss Fuse Service Works 6.0.0 Via RHSA-2014:0459 https://rhn.redhat.com/errata/RHSA-2014-0459.html
This issue has been addressed in following products: Red Hat JBoss Data Virtualization 6.0.0 Via RHSA-2014:0458 https://rhn.redhat.com/errata/RHSA-2014-0458.html
This issue has been addressed in following products: Red Hat JBoss Operations Network 3.2.1 Via RHSA-2014:0511 https://rhn.redhat.com/errata/RHSA-2014-0511.html
This issue has been addressed in following products: JBoss Enterprise Web Server 2.0.1 Via RHSA-2014:0528 https://rhn.redhat.com/errata/RHSA-2014-0528.html
This issue has been addressed in following products: JBoss Enterprise Web Server 2.0.1 Via RHSA-2014:0527 https://rhn.redhat.com/errata/RHSA-2014-0527.html
This issue has been addressed in following products: JBEWS 2 for RHEL 5 JBEWS 2 for RHEL 6 Via RHSA-2014:0525 https://rhn.redhat.com/errata/RHSA-2014-0525.html
This issue has been addressed in following products: JBEWS 2 for RHEL 5 JBEWS 2 for RHEL 6 Via RHSA-2014:0526 https://rhn.redhat.com/errata/RHSA-2014-0526.html
This issue has been addressed in following products: Red Hat Enterprise Linux 7 Via RHSA-2014:0686 https://rhn.redhat.com/errata/RHSA-2014-0686.html
I want to know how can I show this bug to others , for example how can I demonstration this bug to my colleague, to make him konw that multiple content-length header poisoning flaws . thanks a lot !!!
(In reply to Vincent Danen from comment #0) > The Tomcat fix for CVE-2005-2090 was not complete. It did not cover the > following cases: > > - content-length header with chunked encoding over any HTTP connector > - multiple content-length headers over any AJP connector > > Requests with multiple content-length headers or with a content-length > header when chunked encoding is being used should be rejected as invalid. > When multiple components (firewalls, caches, proxies and Tomcat) process a > sequence of requests where one or more requests contain either multiple > content-length headers or a content-length header when chunked encoding is > being used and several components do not reject the request and make > different decisions as to which content-length header to use an attacker can > poison a web-cache, perform an XSS attack and obtain sensitive information > from requests other then their own. Tomcat now rejects requests with > multiple content-length headers or with a content-length header when chunked > encoding is being used. > > This has been corrected in upstream versions 8.0.0-rc3 [1], 7.0.47 [2], and > 6.0.39 [3]. > > [1] http://svn.apache.org/viewvc?view=revision&revision=1521829 > [2] http://svn.apache.org/viewvc?view=revision&revision=1521854 > [3] http://svn.apache.org/viewvc?view=revision&revision=1552565 I want to know how can I show this bug to others , for example how can I demonstration this bug to my colleague, to make him konw that multiple content-length header poisoning flaws . thanks a lot !!!
(In reply to Vincent Danen from comment #0) > The Tomcat fix for CVE-2005-2090 was not complete. It did not cover the > following cases: > > - content-length header with chunked encoding over any HTTP connector > - multiple content-length headers over any AJP connector > > Requests with multiple content-length headers or with a content-length > header when chunked encoding is being used should be rejected as invalid. > When multiple components (firewalls, caches, proxies and Tomcat) process a > sequence of requests where one or more requests contain either multiple > content-length headers or a content-length header when chunked encoding is > being used and several components do not reject the request and make > different decisions as to which content-length header to use an attacker can > poison a web-cache, perform an XSS attack and obtain sensitive information > from requests other then their own. Tomcat now rejects requests with > multiple content-length headers or with a content-length header when chunked > encoding is being used. > > This has been corrected in upstream versions 8.0.0-rc3 [1], 7.0.47 [2], and > 6.0.39 [3]. > > [1] http://svn.apache.org/viewvc?view=revision&revision=1521829 > [2] http://svn.apache.org/viewvc?view=revision&revision=1521854 > [3] http://svn.apache.org/viewvc?view=revision&revision=1552565 I want to know how can I show this bug to others , for example how can I demonstration this bug to my colleague, to make himself see the processor of how this bug produce. thanks a lot !!!
(In reply to wangchao from comment #37) > I want to know how can I show this bug to others , for example how can I > demonstration this bug to my colleague, to make himself see the processor of > how this bug produce. thanks a lot !!! You will need to approach Tomcat upstream to ask them these questions.
(In reply to Vincent Danen from comment #38) > (In reply to wangchao from comment #37) > > > I want to know how can I show this bug to others , for example how can I > > demonstration this bug to my colleague, to make himself see the processor of > > how this bug produce. thanks a lot !!! > > You will need to approach Tomcat upstream to ask them these questions. so you means that I should ask for help with people who maintenance the tomcat , what I want to know is do you konw how can I touch with them , or do you have the email of them , if you know please tell me , I will appreciate a lot wangchao 2014/08/21
(In reply to wangchao from comment #39) ... > > You will need to approach Tomcat upstream to ask them these questions. > > so you means that I should ask for help with people who maintenance > the tomcat , what I want to know is do you konw how can I touch > with them , or do you have the email of them , if you know please > tell me , I will appreciate a lot It's not hard to find. http://tomcat.apache.org/contact.html
tomcat-7.0.52-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: JBoss Portal 6.2.0 Via RHSA-2015:1009 https://rhn.redhat.com/errata/RHSA-2015-1009.html