CVE-2016-3092 | BDVDB-2026-76789 Detail
Description#
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
- CWE-20 Improper Input Validation
References#
- http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121
- https://security.netapp.com/advisory/ntap-20190212-0001/
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759
- http://svn.apache.org/viewvc?view=revision&revision=1743480
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- https://security.gentoo.org/glsa/201705-09
- http://svn.apache.org/viewvc?view=revision&revision=1743738
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840
- http://tomcat.apache.org/security-9.html
- http://www.ubuntu.com/usn/USN-3024-1
- http://rhn.redhat.com/errata/RHSA-2016-2069.html
- http://www.securitytracker.com/id/1037029
- http://rhn.redhat.com/errata/RHSA-2016-2068.html
- http://tomcat.apache.org/security-7.html
- http://www.securitytracker.com/id/1036900
Show all 40
- http://www.securityfocus.com/bid/91453
- http://tomcat.apache.org/security-8.html
- http://rhn.redhat.com/errata/RHSA-2016-2072.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://svn.apache.org/viewvc?view=revision&revision=1743722
- http://www.debian.org/security/2016/dsa-3611
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371
- http://rhn.redhat.com/errata/RHSA-2016-2807.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
- http://jvn.jp/en/jp/JVN89379547/index.html
- http://www.securitytracker.com/id/1036427
- http://rhn.redhat.com/errata/RHSA-2016-2070.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://rhn.redhat.com/errata/RHSA-2016-2808.html
- http://www.securitytracker.com/id/1039606
- http://svn.apache.org/viewvc?view=revision&revision=1743742
- http://rhn.redhat.com/errata/RHSA-2016-2599.html
- http://www.debian.org/security/2016/dsa-3609
- https://access.redhat.com/errata/RHSA-2017:0455
- http://www.debian.org/security/2016/dsa-3614
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E
- https://access.redhat.com/errata/RHSA-2017:0456
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.