CVE-2014-0050
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 82.8%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 82.77% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- oracle/retail applications · apache/commons fileupload · apache/tomcat
- Source
- secalert@redhat.com
References
- http://advisories.mageia.org/MGASA-2014-0110.html
- http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.htmlExploit
- http://jvn.jp/en/jp/JVN14876762/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017
- http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
- http://marc.info/?l=bugtraq&m=143136844732487&w=2
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
- http://rhn.redhat.com/errata/RHSA-2014-0252.html
- http://rhn.redhat.com/errata/RHSA-2014-0253.html
- http://rhn.redhat.com/errata/RHSA-2014-0400.html
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://secunia.com/advisories/57915
- http://secunia.com/advisories/58075
- http://secunia.com/advisories/58976
- http://secunia.com/advisories/59039
- http://secunia.com/advisories/59041
- http://secunia.com/advisories/59183
- http://secunia.com/advisories/59184
- http://secunia.com/advisories/59185
- http://secunia.com/advisories/59187
- http://secunia.com/advisories/59232
- http://secunia.com/advisories/59399
- http://secunia.com/advisories/59492
- http://secunia.com/advisories/59500
- http://secunia.com/advisories/59725
- http://secunia.com/advisories/60475
- http://secunia.com/advisories/60753
- http://svn.apache.org/r1565143Patch
- http://tomcat.apache.org/security-7.htmlPatch, Vendor Advisory
- http://tomcat.apache.org/security-8.htmlPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.