GitHub Advisoryadvisory · Maven

GHSA-pqr5-9v2j-44xg Apache Tomcat DoS via Malicious Get Request

HIGH Published 2022-04-30 Modified 2024-02-12 Official page ↗
Aliases
CVE-2002-2272
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
High
Weaknesses
CWE-119
Reviewed
2024-02-12

Affected packages

• Maven org.apache.tomcat:tomcat: >= 4.0.0, <= 4.1.12 (no fix yet)

Description

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

Related

Alias · CVE (1)

  • CVE-2002-2272 Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References