This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 873695 - (CVE-2012-2733) CVE-2012-2733 tomcat: HTTP NIO connector OOM DoS via a request with large headers
CVE-2012-2733 tomcat: HTTP NIO connector OOM DoS via a request with large hea...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20121105,repor...
: Security
Depends On: 873703 873707 881602 881603 881605
Blocks: 873710
  Show dependency treegraph
 
Reported: 2012-11-06 09:03 EST by Jan Lieskovsky
Modified: 2013-07-01 00:23 EDT (History)
12 users (show)

See Also:
Fixed In Version: Apache Tomcat 6.0.36, Apache Tomcat 7.0.28
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-06-30 20:44:49 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-11-06 09:03:22 EST
A denial of service flaw was found in the way Tomcat's HTTP NIO connector enforced limits on the permitted size of request headers. A remote attacker could use this flaw to trigger an OutOfMemoryError by sending a specially-crafted request with very large headers.

This flaw affects all versions of Tomcat up to 6.0.35 [1] and 7.0.27 [2].

[1] http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36
[2] http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.28

Relevant upstream patches are:
Tomcat 6: http://svn.apache.org/viewvc?view=rev&rev=1356208
Tomcat 7: http://svn.apache.org/viewvc?view=rev&rev=1350301
Comment 1 Jan Lieskovsky 2012-11-06 09:05:47 EST
This issue affects the version of the tomcat6 package as shipped with JBoss Enterprise Web Server 1.0.2.

--

This issue affects the versions of the tomcat6 package, as shipped with Fedora release of 16 and 17.
Comment 3 Jan Lieskovsky 2012-11-06 09:10:51 EST
Relevant upstream patch for Tomcat 7:
[3] http://svn.apache.org/viewvc?view=rev&rev=1350301

Affected Tomcat 7 versions: From 7.0.0 up to 7.0.27.
Comment 4 Jan Lieskovsky 2012-11-06 09:14:37 EST
This issue affects the version of the tomcat package, as shipped with Fedora release of 16.

--

This issue did not affect the version of the tomcat package, as shipped with Fedora release of 17 (that version was already updated).
Comment 5 Jan Lieskovsky 2012-11-06 09:17:22 EST
Created tomcat6 tracking bugs for this issue

Affects: fedora-all [bug 873703]
Comment 6 Jan Lieskovsky 2012-11-06 09:22:48 EST
Created tomcat tracking bugs for this issue

Affects: fedora-16 [bug 873707]
Comment 7 Arun Babu Neelicattu 2012-11-29 03:12:21 EST
This flaw does not affect jbossweb as the NIO connector is not present.
Comment 9 Fedora Update System 2012-12-19 03:29:13 EST
tomcat-7.0.33-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2013-02-19 15:30:51 EST
This issue has been addressed in following products:

  JBoss Enterprise Web Server 2.0.0

Via RHSA-2013:0265 https://rhn.redhat.com/errata/RHSA-2013-0265.html
Comment 14 errata-xmlrpc 2013-02-19 17:14:55 EST
This issue has been addressed in following products:

  JBEWS 2 for RHEL 5
  JBEWS 2 for RHEL 6

Via RHSA-2013:0266 https://rhn.redhat.com/errata/RHSA-2013-0266.html

Note You need to log in before you can comment on or make changes to this bug.