GHSA-wr3m-gw98-mc3j

Dashboard / Vulnerabilities / GHSA-wr3m-gw98-mc3j

GHSA-wr3m-gw98-mc3j

Published: 14 May 2022Last Modified: 8 Nov 2023

Aliases:

CVE-2011-4858

Summary: Improper Input Validation in Apache Tomcat

Details: Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

References: https://nvd.nist.gov/vuln/detail/CVE-2011-4858, https://bugzilla.redhat.com/show_bug.cgi?id=750521, https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py, https://github.com/apache/tomcat, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886, http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%[email protected]%3e, http://marc.info/?l=bugtraq&m=132871655717248&w=2, http://marc.info/?l=bugtraq&m=133294394108746&w=2, http://marc.info/?l=bugtraq&m=136485229118404&w=2, http://rhn.redhat.com/errata/RHSA-2012-0074.html, http://rhn.redhat.com/errata/RHSA-2012-0075.html, http://rhn.redhat.com/errata/RHSA-2012-0076.html, http://tomcat.apache.org/tomcat-7.0-doc/changelog.html, http://www.debian.org/security/2012/dsa-2401, http://www.kb.cert.org/vuls/id/903934, http://www.nruns.com/_downloads/advisory28122011.pdf, http://www.ocert.org/advisories/ocert-2011-003.html

Affected packages

Package

Name: org.apache.tomcat:tomcat

Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 5.5.0

Fixed -5.5.35

Affected versions

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High