CVE-2016-3092
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 35.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 35.93% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- hp/icewall identity manager · hp/icewall sso agent option · apache/tomcat · debian/debian linux · apache/commons fileupload · canonical/ubuntu linux
- Source
- secalert@redhat.com
References
- http://jvn.jp/en/jp/JVN89379547/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121VDB Entry, Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
- http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3EMailing List
- http://rhn.redhat.com/errata/RHSA-2016-2068.html
- http://rhn.redhat.com/errata/RHSA-2016-2069.html
- http://rhn.redhat.com/errata/RHSA-2016-2070.html
- http://rhn.redhat.com/errata/RHSA-2016-2071.html
- http://rhn.redhat.com/errata/RHSA-2016-2072.html
- http://rhn.redhat.com/errata/RHSA-2016-2599.html
- http://rhn.redhat.com/errata/RHSA-2016-2807.html
- http://rhn.redhat.com/errata/RHSA-2016-2808.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://svn.apache.org/viewvc?view=revision&revision=1743480
- http://svn.apache.org/viewvc?view=revision&revision=1743722Vendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1743738Vendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1743742Vendor Advisory
- http://tomcat.apache.org/security-7.htmlVendor Advisory
- http://tomcat.apache.org/security-8.htmlVendor Advisory
- http://tomcat.apache.org/security-9.htmlVendor Advisory
- http://www.debian.org/security/2016/dsa-3609Third Party Advisory
- http://www.debian.org/security/2016/dsa-3611Third Party Advisory
- http://www.debian.org/security/2016/dsa-3614Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securityfocus.com/bid/91453Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036427
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.