CVE-2014-0230: Uncontrolled Resource Consumption in Apache Tomcat
Summary
CVE-2014-0230: Uncontrolled Resource Consumption in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 6.0.0, < 6.0.44
>= 7.0.0, < 7.0.55
>= 8.0.0, < 8.0.9
Fixed in 6.0.44, 7.0.55 or 8.0.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java HTTP web server environment for running Java code. Apache Tomcat versions 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 are affected by a vulnerability that allows remote attackers to cause a denial of service (thread consumption) by sending a series of aborted upload attempts before the reading of the entire request body is finished.
Vulnerability Detail
The vulnerability in Apache Tomcat arises from its improper handling of cases where an HTTP response occurs before the reading of an entire request body is completed. This flaw can be exploited by remote attackers to consume all available threads, leading to a denial of service. By sending a series of aborted upload attempts, an attacker can exhaust the server's thread pool, preventing it from handling legitimate requests. This vulnerability has a high severity rating and is identified by the CVE identifier CVE-2014-0230.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.446.0.44 -
>= 7.0.0, < 7.0.557.0.55 -
>= 8.0.0, < 8.0.98.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions of Apache Tomcat as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apache Tomcat can be exploited by remote attackers to cause a denial of service by consuming all available threads. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Apache Tomcat or apply the official patches. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
Apache Tomcat versions 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 are affected by this vulnerability.
This vulnerability allows remote attackers to cause a denial of service by consuming all available threads, leading to unresponsiveness of the server.
No, there is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions of Apache Tomcat.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat as mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
