rhsa-2014_0865
Vulnerability from csaf_redhat
Published
2014-07-09 15:16
Modified
2024-09-15 21:32
Summary
Red Hat Security Advisory: tomcat6 security and bug fix update
Notes
Topic
Updated tomcat6 packages that fix three security issues and two bugs are
now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.
It was discovered that Apache Tomcat did not limit the length of chunk
sizes when using chunked transfer encoding. A remote attacker could use
this flaw to perform a denial of service attack against Tomcat by streaming
an unlimited quantity of data, leading to excessive consumption of server
resources. (CVE-2014-0075)
It was found that Apache Tomcat did not check for overflowing values when
parsing request content length headers. A remote attacker could use this
flaw to perform an HTTP request smuggling attack on a Tomcat server located
behind a reverse proxy that processed the content length header correctly.
(CVE-2014-0099)
It was found that the org.apache.catalina.servlets.DefaultServlet
implementation in Apache Tomcat allowed the definition of XML External
Entities (XXEs) in provided XSLTs. A malicious application could use this
to circumvent intended security restrictions to disclose sensitive
information. (CVE-2014-0096)
The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product
Security.
This update also fixes the following bugs:
* The patch that resolved the CVE-2014-0050 issue contained redundant code.
This update removes the redundant code. (BZ#1094528)
* The patch that resolved the CVE-2013-4322 issue contained an invalid
check that triggered a java.io.EOFException while reading trailer headers
for chunked requests. This update fixes the check and the aforementioned
exception is no longer triggered in the described scenario. (BZ#1095602)
All Tomcat 6 users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. Tomcat must be
restarted for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated tomcat6 packages that fix three security issues and two bugs are\nnow available for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer\nPages (JSP) technologies.\n\nIt was discovered that Apache Tomcat did not limit the length of chunk\nsizes when using chunked transfer encoding. A remote attacker could use\nthis flaw to perform a denial of service attack against Tomcat by streaming\nan unlimited quantity of data, leading to excessive consumption of server\nresources. (CVE-2014-0075)\n\nIt was found that Apache Tomcat did not check for overflowing values when\nparsing request content length headers. A remote attacker could use this\nflaw to perform an HTTP request smuggling attack on a Tomcat server located\nbehind a reverse proxy that processed the content length header correctly.\n(CVE-2014-0099)\n\nIt was found that the org.apache.catalina.servlets.DefaultServlet\nimplementation in Apache Tomcat allowed the definition of XML External\nEntities (XXEs) in provided XSLTs. A malicious application could use this\nto circumvent intended security restrictions to disclose sensitive\ninformation. (CVE-2014-0096)\n\nThe CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product\nSecurity.\n\nThis update also fixes the following bugs:\n\n* The patch that resolved the CVE-2014-0050 issue contained redundant code.\nThis update removes the redundant code. (BZ#1094528)\n\n* The patch that resolved the CVE-2013-4322 issue contained an invalid\ncheck that triggered a java.io.EOFException while reading trailer headers\nfor chunked requests. This update fixes the check and the aforementioned\nexception is no longer triggered in the described scenario. (BZ#1095602)\n\nAll Tomcat 6 users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. Tomcat must be\nrestarted for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0865",
"url": "https://access.redhat.com/errata/RHSA-2014:0865"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html",
"url": "https://tomcat.apache.org/security-6.html"
},
{
"category": "external",
"summary": "1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "1095602",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095602"
},
{
"category": "external",
"summary": "1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2014/rhsa-2014_0865.json"
}
],
"title": "Red Hat Security Advisory: tomcat6 security and bug fix update",
"tracking": {
"current_release_date": "2024-09-15T21:32:44+00:00",
"generator": {
"date": "2024-09-15T21:32:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2014:0865",
"initial_release_date": "2014-07-09T15:16:10+00:00",
"revision_history": [
{
"date": "2014-07-09T15:16:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-07-09T15:16:10+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-15T21:32:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat6-0:6.0.24-72.el6_5.src",
"product": {
"name": "tomcat6-0:6.0.24-72.el6_5.src",
"product_id": "tomcat6-0:6.0.24-72.el6_5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.24-72.el6_5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat6-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-lib@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.24-72.el6_5?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"product": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"product_id": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.24-72.el6_5?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
"product_id": "6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Client-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
"product_id": "6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6ComputeNode-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
"product_id": "6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Server-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-72.el6_5.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src"
},
"product_reference": "tomcat6-0:6.0.24-72.el6_5.src",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
"product_id": "6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"relates_to_product_reference": "6Workstation-optional-6.5.z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"David Jorm"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2014-0075",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1072776"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to excessive consumption of server resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0075"
},
{
"category": "external",
"summary": "RHBZ#1072776",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072776"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0075"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0865"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter"
},
{
"cve": "CVE-2014-0096",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2014-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1088342"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0096"
},
{
"category": "external",
"summary": "RHBZ#1088342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1088342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0096"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0865"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs"
},
{
"cve": "CVE-2014-0099",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2014-05-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1102030"
}
],
"notes": [
{
"category": "description",
"text": "It was found that JBoss Web / Apache Tomcat did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web / Apache Tomcat server located behind a reverse proxy that processed the content length header correctly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JBossWeb: Request smuggling via malicious content length header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0099"
},
{
"category": "external",
"summary": "RHBZ#1102030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0099"
}
],
"release_date": "2014-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0865"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Client-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Client-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6ComputeNode-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6ComputeNode-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Server-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Server-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-0:6.0.24-72.el6_5.src",
"6Workstation-optional-6.5.z:tomcat6-admin-webapps-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-docs-webapp-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-el-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-javadoc-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-jsp-2.1-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-lib-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-servlet-2.5-api-0:6.0.24-72.el6_5.noarch",
"6Workstation-optional-6.5.z:tomcat6-webapps-0:6.0.24-72.el6_5.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JBossWeb: Request smuggling via malicious content length header"
}
]
}
Loading...