Описание
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security (TLS) handshake. Successful exploitation causes the Java Virtual Machine (JVM) to crash, resulting in a denial of service (DoS).
Отчет
Red Hat rates this flaw as Important. An unauthenticated remote attacker can trigger a denial of service by exploiting a buffer over-read in Apache Tomcat Native during the TLS handshake, causing the JVM to crash. The issue affects deployments using vulnerable Tomcat Native versions.
Меры по смягчению последствий
Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16, as appropriate for the version line. For Red Hat JBoss Web Server, apply the corresponding Red Hat update for the affected stream when available. The Apache advisory does not specify an alternate workaround.
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Buffer over-read vulnerability in Apache Tomcat Native during the TLS ...
EPSS
7.5 High
CVSS3