Mandriva Linux Security Advisory : apache-commons-fileupload (MDVSA-2014:056)

Medium Nessus Plugin ID 73003


The remote Mandriva Linux host is missing one or more security updates.


Updated apache-commons-fileupload packages fix security vulnerability :

It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition (CVE-2014-0050).

Tomcat 7 includes an embedded copy of the Apache Commons FileUpload package, and was affected as well.

Additionally a build problem with maven was discovered, fixed maven packages is also being provided with this advisory.


Update the affected packages.

See Also

Plugin Details

Severity: Medium

ID: 73003

File Name: mandriva_MDVSA-2014-056.nasl

Version: $Revision: 1.4 $

Type: local

Published: 2014/03/14

Modified: 2015/01/14

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:apache-commons-fileupload, p-cpe:/a:mandriva:linux:apache-commons-fileupload-javadoc, p-cpe:/a:mandriva:linux:maven, p-cpe:/a:mandriva:linux:maven-javadoc, p-cpe:/a:mandriva:linux:tomcat, p-cpe:/a:mandriva:linux:tomcat-admin-webapps, p-cpe:/a:mandriva:linux:tomcat-docs-webapp, p-cpe:/a:mandriva:linux:tomcat-el-2.2-api, p-cpe:/a:mandriva:linux:tomcat-javadoc, p-cpe:/a:mandriva:linux:tomcat-jsp-2.2-api, p-cpe:/a:mandriva:linux:tomcat-jsvc, p-cpe:/a:mandriva:linux:tomcat-lib, p-cpe:/a:mandriva:linux:tomcat-servlet-3.0-api, p-cpe:/a:mandriva:linux:tomcat-webapps, cpe:/o:mandriva:business_server:1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/03/13

Reference Information

CVE: CVE-2014-0050

BID: 65400

MDVSA: 2014:056