CVE-2014-0095

描述

java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.

如何修補 CVE-2014-0095

要修補 CVE-2014-0095,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat.embed:tomcat-embed-core—升級至 8.0.4 或更新版本
• Maven/org.apache.tomcat:tomcat-coyote—升級至 8.0.4 或更新版本

CVE-2014-0095 正在被利用嗎?

中等 — EPSS 為 8.5%,可持續追蹤但非最高優先。

受影響套件(2)

• >= 8.0.0-RC1, < 8.0.4
• >= 8.0.0-RC1, < 8.0.4

參考連結(14)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-0095
• PATCHgithub.com/apache/tomcat
• WEBseclists.org/fulldisclosure/2014/May/134
• WEBsvn.apache.org/viewvc?view=revision&revision=1578392
• WEBtomcat.apache.org