CVE-2010-2227
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 54.8%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
- EPSS
- 54.78% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- apache/tomcat
- Source
- secalert@redhat.com
References
- http://geronimo.apache.org/21x-security-report.html
- http://geronimo.apache.org/22x-security-report.html
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050207.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050214.html
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
- http://marc.info/?l=bugtraq&m=129070310906557&w=2
- http://marc.info/?l=bugtraq&m=136485229118404&w=2
- http://marc.info/?l=bugtraq&m=139344343412337&w=2
- http://secunia.com/advisories/40813
- http://secunia.com/advisories/41025
- http://secunia.com/advisories/42079
- http://secunia.com/advisories/42368
- http://secunia.com/advisories/42454
- http://secunia.com/advisories/43310
- http://secunia.com/advisories/44183
- http://secunia.com/advisories/57126
- http://securitytracker.com/id?1024180
- http://support.apple.com/kb/HT5002
- http://svn.apache.org/viewvc?view=revision&revision=958911Patch
- http://svn.apache.org/viewvc?view=revision&revision=958977Patch
- http://svn.apache.org/viewvc?view=revision&revision=959428Patch
- http://tomcat.apache.org/security-5.htmlVendor Advisory
- http://tomcat.apache.org/security-6.htmlVendor Advisory
- http://tomcat.apache.org/security-7.htmlVendor Advisory
- http://www.debian.org/security/2011/dsa-2207
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:176
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:177
- http://www.novell.com/support/viewContent.do?externalId=7007274
- http://www.novell.com/support/viewContent.do?externalId=7007275
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.