The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
http://jvn.jp/en/jp/JVN89379547/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121
http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
http://rhn.redhat.com/errata/RHSA-2016-2068.html
http://rhn.redhat.com/errata/RHSA-2016-2069.html
http://rhn.redhat.com/errata/RHSA-2016-2070.html
http://rhn.redhat.com/errata/RHSA-2016-2071.html
http://rhn.redhat.com/errata/RHSA-2016-2072.html
http://rhn.redhat.com/errata/RHSA-2016-2599.html
http://rhn.redhat.com/errata/RHSA-2016-2807.html
http://rhn.redhat.com/errata/RHSA-2016-2808.html
http://rhn.redhat.com/errata/RHSA-2017-0457.html
http://svn.apache.org/viewvc?view=revision&revision=1743480
http://svn.apache.org/viewvc?view=revision&revision=1743722
http://svn.apache.org/viewvc?view=revision&revision=1743738
http://svn.apache.org/viewvc?view=revision&revision=1743742
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-9.html
http://www.debian.org/security/2016/dsa-3609
http://www.debian.org/security/2016/dsa-3611
http://www.debian.org/security/2016/dsa-3614
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
http://www.securityfocus.com/bid/91453
http://www.securitytracker.com/id/1036427
http://www.securitytracker.com/id/1036900
http://www.securitytracker.com/id/1037029
http://www.securitytracker.com/id/1039606
http://www.ubuntu.com/usn/USN-3024-1
http://www.ubuntu.com/usn/USN-3027-1
https://access.redhat.com/errata/RHSA-2017:0455
https://access.redhat.com/errata/RHSA-2017:0456
https://bugzilla.redhat.com/show_bug.cgi?id=1349468
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://security.gentoo.org/glsa/201705-09
https://security.netapp.com/advisory/ntap-20190212-0001/
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Source: MITRE
Published: 2016-07-04
Updated: 2019-04-23
Type: CWE-20
Base Score: 7.8
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Impact Score: 6.9
Exploitability Score: 10
Severity: HIGH
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 3.9
Severity: HIGH
OR
OR
cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*
OR
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.32:*:*:*:*:*:*:*
OR
OR
OR
cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:* versions up to 1.3.1 (inclusive)
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
OR
cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*
ID | Name | Product | Family | Severity |
---|---|---|---|---|
126467 | Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jul 2017 CPU) | Nessus | Misc. | medium |
121119 | Apache Tomcat 7.0.x < 7.0.70 / 8.0.x < 8.0.36 / 8.5.x < 8.5.3 / 9.0.x < 9.0.0.M8 Denial of Service | Nessus | Web Servers | high |
112248 | RHEL 7 : JBoss EAP (RHSA-2016:2069) | Nessus | Red Hat Local Security Checks | high |
112192 | Apache ActiveMQ 5.x < 5.15.5 Multiple Vulnerabilities | Nessus | CGI abuses | high |
109209 | Oracle WebCenter Sites Remote Vulnerability (April 2018 CPU) | Nessus | Windows | medium |
103962 | Oracle GlassFish Server 3.0.1.x < 3.0.1.17 / 3.1.2.x < 3.1.2.18 (October 2017 CPU) | Nessus | Web Servers | high |
101837 | Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy) | Nessus | Misc. | high |
100262 | GLSA-201705-09 : Apache Tomcat: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
99816 | EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2016-1054) | Nessus | Huawei Local Security Checks | high |
99594 | Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (April 2017 CPU) (SWEET32) | Nessus | Misc. | critical |
99593 | MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU) | Nessus | CGI abuses | critical |
97596 | RHEL 7 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0456) | Nessus | Red Hat Local Security Checks | high |
97595 | RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455) | Nessus | Red Hat Local Security Checks | high |
9941 | Atlassian Bitbucket Server 4.x < 4.8.2 Directory Traversal | Nessus Network Monitor | CGI | high |
9905 | Apache Tomcat 7.0.x < 7.0.70 / 8.0.x < 8.0.36 / 8.5.x < 8.5.3 / 9.x < 9.0.0.M8 Denial of Service (deprecated) | Nessus Network Monitor | Web Servers | high |
9904 | Apache TomEE 7.x < 7.0.1 DoS | Nessus Network Monitor | Web Servers | high |
700700 | Apache Tomcat 7.0.x < 7.0.70 / 8.0.x < 8.0.36 / 8.5.x < 8.5.3 / 9.x < 9.0.0.M8 Denial of Service | Nessus Network Monitor | Web Servers | high |
95882 | IBM Domino 8.5.x < 8.5.3 Fix Pack 6 Interim Fix 15 / 9.0.x < 9.0.1 Fix Pack 7 Interim Fix 1 Multiple Vulnerabilities | Nessus | Misc. | medium |
95863 | Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161103) | Nessus | Scientific Linux Local Security Checks | high |
95345 | CentOS 7 : tomcat (CESA-2016:2599) | Nessus | CentOS Local Security Checks | high |
95024 | RHEL 6 / 7 : JBoss Web Server (RHSA-2016:2807) | Nessus | Red Hat Local Security Checks | high |
94880 | Fedora 25 : 1:tomcat (2016-f4a443888b) | Nessus | Fedora Local Security Checks | high |
94718 | Oracle Linux 7 : tomcat (ELSA-2016-2599) | Nessus | Oracle Linux Local Security Checks | high |
94562 | RHEL 7 : tomcat (RHSA-2016:2599) | Nessus | Red Hat Local Security Checks | high |
94104 | RHEL 6 : jboss-ec2-eap (RHSA-2016:2072) | Nessus | Red Hat Local Security Checks | high |
93362 | openSUSE Security Update : tomcat (openSUSE-2016-1056) (httpoxy) | Nessus | SuSE Local Security Checks | high |
93260 | Fedora 24 : 1:tomcat (2016-2b0c16fd82) | Nessus | Fedora Local Security Checks | high |
93259 | Fedora 23 : 1:tomcat (2016-0a4dccdd23) | Nessus | Fedora Local Security Checks | high |
93014 | Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2016-736) | Nessus | Amazon Linux Local Security Checks | high |
92342 | FreeBSD : Apache Commons FileUpload -- denial of service (61b8c359-4aab-11e6-a7bd-14dae9d210b8) | Nessus | FreeBSD Local Security Checks | high |
91968 | Ubuntu 16.04 LTS : tomcat8 vulnerability (USN-3027-1) | Nessus | Ubuntu Local Security Checks | high |
91954 | Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : tomcat6, tomcat7 vulnerabilities (USN-3024-1) | Nessus | Ubuntu Local Security Checks | high |
91925 | Debian DSA-3614-1 : tomcat7 - security update | Nessus | Debian Local Security Checks | high |
91907 | Debian DSA-3611-1 : libcommons-fileupload-java - security update | Nessus | Debian Local Security Checks | high |
91906 | Debian DSA-3609-1 : tomcat8 - security update | Nessus | Debian Local Security Checks | high |
91841 | FreeBSD : Apache Commons FileUpload -- denial of service (DoS) vulnerability (cbceeb49-3bc7-11e6-8e82-002590263bf5) | Nessus | FreeBSD Local Security Checks | high |
91835 | Debian DLA-529-1 : tomcat7 security update | Nessus | Debian Local Security Checks | high |
91834 | Debian DLA-528-1 : libcommons-fileupload-java security update | Nessus | Debian Local Security Checks | high |