Advisory details:
github_osv / GHSA-cxg2-49rq-8gcr
| Advisory ID | github_osv/GHSA-cxg2-49rq-8gcr |
| Aliases |
CVE-2010-2227
|
| Summary | Apache Tomcat does not properly handle an invalid Transfer-Encoding header Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | MODERATE |
| Data source | Metasploit |
|---|---|
| Description | Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." |
| Note | Stability: - crash-service-down SideEffects: [] Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | July 9, 2010 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb |
| Data source | Metasploit |
|---|---|
| Description | Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to-but never completing-the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool, eventually denying additional connection attempts from clients. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source publication date | June 17, 2009 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/slowloris.py |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.