CVE-2017-6056
Summary
| CVE | CVE-2017-6056 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-02-17 07:59:00 UTC |
| Updated | 2023-11-07 02:49:00 UTC |
| Description | It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu. |
Risk And Classification
Problem Types: CWE-835
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Third Party Advisory |
| [SECURITY] [DSA 3787-1] tomcat7 security update | CONFIRM | lists.debian.org | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Debian -- Security Information -- DSA-3788-1 tomcat8 | DEBIAN | www.debian.org | Third Party Advisory |
| Debian -- Security Information -- DSA-3787-1 tomcat7 | DEBIAN | www.debian.org | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| November 2017 Apache Tomcat Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| 60578 – Server CPU maxed out (100% per core) randomly after a few hours | CONFIRM | bz.apache.org | Issue Tracking, Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Apache Tomcat 'http11/AbstractInputBuffer.java' Denial of Service Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| #851304 - tomcat8 use 100% cpu time - Debian Bug report logs | CONFIRM | bugs.debian.org | Issue Tracking, Third Party Advisory |
| [SECURITY] [DSA 3788-1] tomcat8 security update | CONFIRM | lists.debian.org | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Third Party Advisory |
| Oracle Critical Patch Update - October 2019 | MISC | www.oracle.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Third Party Advisory |
| Apache Tomcat HTTPS Request Processing Bug Lets Remote Users Deny Service - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.