Patchfirst
Patchfirst
CVE-2011-4858 Public exploit EPSS 79.7%

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without…

Summary

The flaw is in Apache Tomcat's handling of form parameters, which are hashed without restriction on predictable hash collisions in the affected 5.5.x, 6.x, and 7.x releases before the fixed versions. An attacker with network access can send requests containing many crafted parameters, requiring no authentication or user interaction, to consume CPU and cause a denial of service.

Official description · CVE.org

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Breakdown
24.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Exploit-DB) was available 5 years before disclosure.

  1. Public exploit codeExploit-DB5 yrs before
  2. Disclosedday 0

7 fixes in tomcat over 23 months. The latest fix listed for tomcat is 7.0.30.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 7.0.19CVE-2011-252614 Jul 2011
  2. 7.0.21CVE-2011-319031 Aug 2011
  3. 7.0.22CVE-2011-337519 Jan 2012
  4. 7.0.23CVE-2011-48585 Jan 2012
  5. 7.0.23CVE-2012-002219 Jan 2012
  6. 7.0.30CVE-2012-354619 Dec 2012
  7. 7.0.30CVE-2012-35441 Jun 2013Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-wr3m-gw98-mc3j

Upgrade to 7.0.105 or later

Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2009-3555, CVE-2010-2227, +3).

Set the version to 7.0.105 or later in your pom.xml or build.gradle.

First fixed in 7.0.23 for CVE-2011-4858.

Affected versions, by release line

If you runUpgrade to
7.0.0 up to 7.0.237.0.105first fix for this CVE: 7.0.23
6.0.0 up to 6.0.356.0.35
5.5.0 up to 5.5.355.5.35

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

26 links, grouped by NVD tag

x_refsource_MISC 3

github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.pynruns.com/_downloads/advisory28122011.pdfocert.org/advisories/ocert-2011-003.html

vendor-advisory 12

debian.org/security/2012/dsa-2401rhn.redhat.com/errata/RHSA-2012-0325.htmlmarc.info/?l=bugtraq&m=136485229118404&w=2rhn.redhat.com/errata/RHSA-2012-0078.htmlrhn.redhat.com/errata/RHSA-2012-0075.htmlrhn.redhat.com/errata/RHSA-2012-0074.htmlrhn.redhat.com/errata/RHSA-2012-0089.htmlmarc.info/?l=bugtraq&m=133294394108746&w=2
Show 4 moreShow fewermarc.info/?l=bugtraq&m=132871655717248&w=2rhn.redhat.com/errata/RHSA-2012-0406.htmlrhn.redhat.com/errata/RHSA-2012-0076.htmlrhn.redhat.com/errata/RHSA-2012-0077.html

vdb-entry 2

securityfocus.com/bid/51200oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886

x_refsource_CONFIRM 2

bugzilla.redhat.com/show_bug.cgi?id=750521tomcat.apache.org/tomcat-7.0-doc/changelog.html

third-party-advisory 6

secunia.com/advisories/48791secunia.com/advisories/48549secunia.com/advisories/54971secunia.com/advisories/48790secunia.com/advisories/55115kb.cert.org/vuls/id/903934

mailing-list 1

mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106%40apache.org%3e
↑ ↓ chooseEnter openEsc close