CVE-2010-2227

描述

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

如何修補 CVE-2010-2227

要修補 CVE-2010-2227,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat:tomcat—升級至 7.0.2 或更新版本

CVE-2010-2227 正在被利用嗎?

可能 — EPSS 為 54.8%,屬於高被利用機率區間,建議優先修補。

受影響套件(1)

• >= 7.0.0, < 7.0.2

參考連結(49)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2010-2227
• PATCHgithub.com/apache/tomcat
• WEBgeronimo.apache.org/21x-security-report.html
• WEBgeronimo.apache.org/22x-security-report.html
• WEB