{"url":"http://public2.vulnerablecode.io/api/packages/61973?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.5.35","type":"maven","namespace":"org.apache.tomcat","name":"tomcat","version":"5.5.35","qualifiers":{},"subpath":"","is_vulnerable":false,"next_non_vulnerable_version":"6.0.17","latest_non_vulnerable_version":"11.0.18","affected_by_vulnerabilities":[],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43273?format=json","vulnerability_id":"VCID-fu9h-e3jx-abe2","summary":"Denial of Service in Apache Tomcat\nApache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.","references":[{"reference_url":"http://marc.info/?l=bugtraq&m=132871655717248&w=2","reference_id":"","reference_type":"","scores":[],"url":"http://marc.info/?l=bugtraq&m=132871655717248&w=2"},{"reference_url":"http://marc.info/?l=bugtraq&m=133294394108746&w=2","reference_id":"","reference_type":"","scores":[],"url":"http://marc.info/?l=bugtraq&m=133294394108746&w=2"},{"reference_url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2","reference_id":"","reference_type":"","scores":[],"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2012-0074.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2012-0074.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2012-0075.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2012-0075.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2012-0076.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2012-0076.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2012-1331.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2012-1331.html"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72425","reference_id":"","reference_type":"","scores":[],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72425"},{"reference_url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16925","reference_id":"","reference_type":"","scores":[],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16925"},{"reference_url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18934","reference_id":"","reference_type":"","scores":[],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18934"},{"reference_url":"http://tomcat.apache.org/security-5.html","reference_id":"","reference_type":"","scores":[],"url":"http://tomcat.apache.org/security-5.html"},{"reference_url":"http://tomcat.apache.org/security-6.html","reference_id":"","reference_type":"","scores":[],"url":"http://tomcat.apache.org/security-6.html"},{"reference_url":"http://tomcat.apache.org/security-7.html","reference_id":"","reference_type":"","scores":[],"url":"http://tomcat.apache.org/security-7.html"},{"reference_url":"http://www.debian.org/security/2012/dsa-2401","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2012/dsa-2401"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0022","reference_id":"CVE-2012-0022","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0022"},{"reference_url":"https://github.com/advisories/GHSA-8h2q-qm9x-55jc","reference_id":"GHSA-8h2q-qm9x-55jc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-8h2q-qm9x-55jc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61973?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.5.35","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.35"},{"url":"http://public2.vulnerablecode.io/api/packages/61974?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@6.0.34","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@6.0.34"},{"url":"http://public2.vulnerablecode.io/api/packages/56512?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@7.0.23","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-wmb3-3j7y-due7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@7.0.23"}],"aliases":["CVE-2012-0022","GHSA-8h2q-qm9x-55jc"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fu9h-e3jx-abe2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43937?format=json","vulnerability_id":"VCID-wtke-y2cx-x3et","summary":"Improper Input Validation in Apache Tomcat\nApache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","references":[{"reference_url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106@apache.org%3e","reference_id":"","reference_type":"","scores":[],"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106@apache.org%3e"},{"reference_url":"http://marc.info/?l=bugtraq&m=132871655717248&w=2","reference_id":"","reference_type":"","scores":[],"url":"http://marc.info/?l=bugtraq&m=132871655717248&w=2"},{"reference_url":"http://marc.info/?l=bugtraq&m=133294394108746&w=2","reference_id":"","reference_type":"","scores":[],"url":"http://marc.info/?l=bugtraq&m=133294394108746&w=2"},{"reference_url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2","reference_id":"","reference_type":"","scores":[],"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2012-0074.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2012-0074.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2012-0075.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2012-0075.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2012-0076.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2012-0076.html"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=750521","reference_id":"","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=750521"},{"reference_url":"https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py"},{"reference_url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886","reference_id":"","reference_type":"","scores":[],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886"},{"reference_url":"http://tomcat.apache.org/tomcat-7.0-doc/changelog.html","reference_id":"","reference_type":"","scores":[],"url":"http://tomcat.apache.org/tomcat-7.0-doc/changelog.html"},{"reference_url":"http://www.debian.org/security/2012/dsa-2401","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2012/dsa-2401"},{"reference_url":"http://www.kb.cert.org/vuls/id/903934","reference_id":"","reference_type":"","scores":[],"url":"http://www.kb.cert.org/vuls/id/903934"},{"reference_url":"http://www.nruns.com/_downloads/advisory28122011.pdf","reference_id":"","reference_type":"","scores":[],"url":"http://www.nruns.com/_downloads/advisory28122011.pdf"},{"reference_url":"http://www.ocert.org/advisories/ocert-2011-003.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.ocert.org/advisories/ocert-2011-003.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4858","reference_id":"CVE-2011-4858","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4858"},{"reference_url":"https://github.com/advisories/GHSA-wr3m-gw98-mc3j","reference_id":"GHSA-wr3m-gw98-mc3j","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-wr3m-gw98-mc3j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61973?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.5.35","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.35"},{"url":"http://public2.vulnerablecode.io/api/packages/63157?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@6.0.35","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@6.0.35"},{"url":"http://public2.vulnerablecode.io/api/packages/56512?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@7.0.23","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-wmb3-3j7y-due7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@7.0.23"}],"aliases":["CVE-2011-4858","GHSA-wr3m-gw98-mc3j"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wtke-y2cx-x3et"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.35"}