CVE-2014-0227: tomcat 6.0.0, 6.0.1, 6.0.2 (+90 more affected versions); +1 more affected products

Affected technology

tomcat · 6.0.0
apache

tomcat · 6.0.0 · update alpha
apache

tomcat · 6.0.1
apache

tomcat · 6.0.1 · update alpha
apache

tomcat · 6.0.2
apache

tomcat · 6.0.2 · update alpha
apache

tomcat · 6.0.2 · update beta
apache

tomcat · 6.0.3
apache

tomcat · 6.0.4
apache

tomcat · 6.0.4 · update alpha
apache

tomcat · 6.0.5
apache

tomcat · 6.0.6
apache

tomcat · 6.0.6 · update alpha
apache

tomcat · 6.0.7
apache

tomcat · 6.0.7 · update alpha
apache

tomcat · 6.0.7 · update beta
apache

tomcat · 6.0.8
apache

tomcat · 6.0.8 · update alpha
apache

tomcat · 6.0.9
apache

tomcat · 6.0.9 · update beta
apache

tomcat · 6.0.10
apache

tomcat · 6.0.11
apache

tomcat · 6.0.12
apache

tomcat · 6.0.13
apache

tomcat · 6.0.14
apache

tomcat · 6.0.15
apache

tomcat · 6.0.16
apache

tomcat · 6.0.17
apache

tomcat · 6.0.18
apache

tomcat · 6.0.19
apache

tomcat · 6.0.20
apache

tomcat · 6.0.24
apache

tomcat · 6.0.26
apache

tomcat · 6.0.27
apache

tomcat · 6.0.28
apache

tomcat · 6.0.29
apache

tomcat · 6.0.30
apache

tomcat · 6.0.31
apache

tomcat · 6.0.32
apache

tomcat · 6.0.33
apache

tomcat · 6.0.35
apache

tomcat · 6.0.36
apache

tomcat · 6.0.37
apache

tomcat · 6.0.39
apache

tomcat · 6.0.41
apache

tomcat · 7.0.0
apache

tomcat · 7.0.0 · update beta
apache

tomcat · 7.0.1
apache

tomcat · 7.0.2
apache

tomcat · 7.0.2 · update beta
apache

tomcat · 7.0.3
apache

tomcat · 7.0.4
apache

tomcat · 7.0.4 · update beta
apache

tomcat · 7.0.5
apache

tomcat · 7.0.6
apache

tomcat · 7.0.7
apache

tomcat · 7.0.8
apache

tomcat · 7.0.9
apache

tomcat · 7.0.10
apache

tomcat · 7.0.11
apache

tomcat · 7.0.12
apache

tomcat · 7.0.13
apache

tomcat · 7.0.14
apache

tomcat · 7.0.15
apache

tomcat · 7.0.16
apache

tomcat · 7.0.17
apache

tomcat · 7.0.18
apache

tomcat · 7.0.19
apache

tomcat · 7.0.20
apache

tomcat · 7.0.21
apache

tomcat · 7.0.22
apache

tomcat · 7.0.23
apache

tomcat · 7.0.24
apache

tomcat · 7.0.25
apache

tomcat · 7.0.26
apache

tomcat · 7.0.27
apache

tomcat · 7.0.28
apache

tomcat · 7.0.29
apache

tomcat · 7.0.30
apache

tomcat · 7.0.31
apache

tomcat · 7.0.32
apache

tomcat · 7.0.33
apache

tomcat · 7.0.34
apache

tomcat · 7.0.35
apache

tomcat · 7.0.36
apache

tomcat · 7.0.37
apache

tomcat · 7.0.38
apache

tomcat · 7.0.39
apache

tomcat · 7.0.40
apache

tomcat · 7.0.41
apache

tomcat · 7.0.42
apache

tomcat · 7.0.43
apache

tomcat · 7.0.44
apache

tomcat · 7.0.45
apache

tomcat · 7.0.46
apache

tomcat · 7.0.47
apache

tomcat · 7.0.48
apache

tomcat · 7.0.49
apache

tomcat · 7.0.50
apache

tomcat · 7.0.52
apache

tomcat · 7.0.53
apache

tomcat · 7.0.54
apache

tomcat · 8.0.0 · update rc1
apache

tomcat · 8.0.0 · update rc10
apache

tomcat · 8.0.0 · update rc2
apache

tomcat · 8.0.0 · update rc5
apache

tomcat · 8.0.1
apache

tomcat · 8.0.3
apache

tomcat · 8.0.5
apache

tomcat · 8.0.8
apache

n/a · n/a
Vendor not specified by the source

Description’s affected range: before 6.0.42

Component: Not specified by the source

Attack conditions (NVD, CVSS 2.0): Network (remote)

What an attacker can do

The source says java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding. NVD’s CVSS 2.0 assessment (base score 6.4/10) rates confidentiality impact as none; integrity and availability impact as partial.