Bugzilla – Bug 789406
VUL-0: CVE-2012-2733: tomcat: HTTP NIO connector OOM DoS via a request with large headers
Last modified: 2014-07-17 09:46:45 UTC
Quote from [1] "The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large headers." Patch available from the upstream repository [2]. [1] http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36 [2] http://svn.apache.org/viewvc?view=revision&revision=1356208
sle-11: 22781 openSUSE: WIP
12.1: 142603 12.2: WIP factory: WIP
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/142603 Maintenance /
12.2: 142908 factory: N/A - this has been fixed by 7.0.28 and there is .30 in factory atm
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/142908 Maintenance /
The SWAMPID for this issue is 50301. This issue was rated as moderate. Please submit fixed packages until 2012-12-12. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/144019 Maintenance /
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/144552 Maintenance /
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/144937 Maintenance /
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/144949 Maintenance /
submitted with the other's security issues
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/144953 Maintenance /
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/144989 Maintenance / https://build.opensuse.org/request/show/144990 Maintenance /
This is an autogenerated message for OBS integration: This bug (789406) was mentioned in https://build.opensuse.org/request/show/145902 Maintenance /
openSUSE-SU-2012:1700-1: An update that fixes 10 vulnerabilities is now available. Category: security (moderate) Bug References: 789406,791423,791424,791426,791679,793391,793394 CVE References: CVE-2009-2693,CVE-2009-2901,CVE-2009-2902,CVE-2012-2733,CVE-2012-3546,CVE-2012-4431,CVE-2012-5568,CVE-2012-5885,CVE-2012-5886,CVE-2012-5887 Sources used: openSUSE 12.1 (src): libtcnative-1-0-1.3.3-3.7.1, tomcat6-6.0.33-3.7.1
openSUSE-SU-2012:1701-1: An update that fixes 10 vulnerabilities is now available. Category: security (moderate) Bug References: 779538,789406,791423,791424,791426,791679,793391,793394 CVE References: CVE-2009-2693,CVE-2009-2901,CVE-2009-2902,CVE-2012-2733,CVE-2012-3546,CVE-2012-4431,CVE-2012-5568,CVE-2012-5885,CVE-2012-5886,CVE-2012-5887 Sources used: openSUSE 12.2 (src): tomcat-7.0.27-2.9.1
Update released for: tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp, tomcat6-javadoc, tomcat6-jsp-2_1-api, tomcat6-lib, tomcat6-servlet-2_5-api, tomcat6-webapps Products: SLE-SERVER 11-SP1-TERADATA (x86_64) SUSE-MANAGER 1.2 (x86_64)
Update released for: tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp, tomcat6-javadoc, tomcat6-jsp-2_1-api, tomcat6-lib, tomcat6-servlet-2_5-api, tomcat6-webapps Products: SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64)
released