tomcat: denial of service via hash collision [LWN.net]

Package(s):

tomcat

CVE #(s):

CVE-2011-4858

Created:

January 19, 2012

Updated:

February 2, 2012

Description:

From the Novell CVE entry:

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Alerts:

openSUSE	openSUSE-SU-2012:0103-1	2012-01-19
Debian	DSA-2401-1	2012-02-02
Ubuntu	USN-1359-1	2012-02-13
Red Hat	RHSA-2012:0474-01	2012-04-11
Red Hat	RHSA-2012:0475-01	2012-04-11
CentOS	CESA-2012:0474	2012-04-11
CentOS	CESA-2012:0475	2012-04-11
Scientific Linux	SL-tomc-20120411	2012-04-11
Scientific Linux	SL-tomc-20120411	2012-04-11
Oracle	ELSA-2012-0474	2012-04-12
Gentoo	201206-24	2012-06-24
Mageia	MGASA-2012-0189	2012-08-02

(Log in to post comments)