Apache Tomcat 7.0.x < 7.0.23 Hash Collision Denial of Service
medium Log Correlation Engine Plugin ID 800616
Synopsis
The remote web server is affected by a denial of service vulnerability.Description
Versions of Tomcat 7.0.x earlier than 7.0.23 are potentially affected by a denial of service vulnerability. Large numbers of crafted form parameters can cause excessive CPU consumption due to hash collisions.Solution
Upgrade to Apache Tomcat 7.0.23 or later.See Also
http://www.nruns.com/_downloads/advisory28122011.pdf
http://www.nessus.org/u?d97dc97c
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23
Plugin Details
Severity: Medium
ID: 800616
Family: Web Servers
Published: 2/22/2012
Updated: 2/22/2012
Nessus ID: 57541
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Temporal Vector: CVSS2#E:F/RL:OF/RC:C
Vulnerability Information
Patch Publication Date: 11/25/2011
Vulnerability Publication Date: 12/28/2011
Reference Information
CVE: CVE-2011-4858, CVE-2012-0022