Apache Tomcat version older than 7.0.28

Description
  • The following problems were fixed in Apache Tomcat version 7.0.28: <br/><br/> <ul> <li> <strong>Important: Denial of service CVE-2012-2733</strong><br/> The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large headers.This was fixed in revision 1350301. </li> <li> <strong>Important: Denial of service CVE-2012-4534</strong><br/> When using the NIO connector with sendfile and HTTPS enabled, if a client breaks the connection while reading the response an infinite loop is entered leading to a denial of service. This was originally reported as bug 52858. This was fixed in revision 1340218. </li> </ul> <br/><br/><span class="bb-navy">Affected Apache Tomcat versions (7.0.0 - 7.0.27).</span><br/>
Remediation
  • Upgrade to the latest version of Apache Tomcat.
References