CVE-2014-0099 (Low) detected in tomcat-util-7.0.42.jar

[mend-for-github-com]

CVE-2014-0099 - Low Severity Vulnerability

Vulnerable Library - tomcat-util-7.0.42.jar

Common code shared by Catalina and Jasper

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/tomcat-util/7.0.42/tomcat-util-7.0.42.jar

Dependency Hierarchy:

• tomcat-catalina-7.0.42.jar (Root Library)
  • ❌ tomcat-util-7.0.42.jar (Vulnerable Library)

Found in HEAD commit: c737fc5941c916098f36b4d4fb04233ff8312691

Found in base branches: dev, master

Vulnerability Details

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

Publish Date: 2014-05-31

URL: CVE-2014-0099

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0099

Release Date: 2014-05-31

Fix Resolution (org.apache.tomcat:tomcat-util): 7.0.53

Direct dependency fix Resolution (org.apache.tomcat:tomcat-catalina): 7.0.53

---

⛑️ Automatic Remediation is available for this issue