CVE-2014-0227 Improper Input Validation in Apache Tomcat
Remote attackers can cause denial of service or HTTP request smuggling in Apache Tomcat by sending malformed chunked transfer coding data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0227?
CVE-2014-0227 is a medium-severity denial of service vulnerability in Apache Tomcat, published on 16 Feb 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Weakness: CWE-19
Which versions are affected by CVE-2014-0227?
6 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat Maven | From 6.0.0 | 6.0.42 |
org.apache.tomcat:tomcat Maven | From 6.0.0 | 6.0.42 |
org.apache.tomcat:tomcat Maven | From 7.0.0 | 7.0.55 |
org.apache.tomcat:tomcat Maven | From 7.0.0 | 7.0.55 |
org.apache.tomcat:tomcat Maven | From 8.0.0 | 8.0.9 |
org.apache.tomcat:tomcat Maven | From 8.0.0 | 8.0.9 |
Linux distribution packages (34)
tomcat6 Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-admin-webapps Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-docs-webapp Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-el-2.1-api Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-javadoc Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-jsp-2.1-api Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-lib Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-servlet-2.5-api Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6-webapps Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-83.el6_6 |
tomcat6 Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-admin-webapps Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-docs-webapp Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-el-2.1-api Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-javadoc Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-jsp-2.1-api Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-lib Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-servlet-2.5-api Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6-webapps Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-83.el6_6 |
tomcat6 Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-admin-webapps Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-docs-webapp Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-el-2.1-api Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-javadoc Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-jsp-2.1-api Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-lib Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-servlet-2.5-api Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6-webapps Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-83.el6_6 |
tomcat6 Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-83.el6_6 |
tomcat6-admin-webapps Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-83.el6_6 |
tomcat6-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-83.el6_6 |
tomcat6-docs-webapp Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-83.el6_6 |
Products include Apache Tomcat.
How do I fix CVE-2014-0227?
Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 6.0.42, 7.0.55 or 8.0.9.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2014-0227 being exploited?
There is no known exploitation of CVE-2014-0227 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as GHSA-42j3-498q-m6vp, MGASA-2015-0081, RHSA-2015:0983, RHSA-2015:0991, UBUNTU-CVE-2014-0227.