Patchfirst
Patchfirst
CVE-2010-2227 Public exploit EPSS 54.8%

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid…

Summary

The flaw is in Apache Tomcat, in how its request handling processes an invalid Transfer-Encoding header, affecting versions 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta. A remote attacker can send a crafted header that interferes with buffer recycling, causing a denial of service or exposing sensitive information, with no authentication indicated as required.

Official description · CVE.org

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

Breakdown
24.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 13 months before disclosure.

  1. Public exploit codeMetasploit13 mo before
  2. Disclosedday 0

See the family tree

A fix was bypassed or incomplete once over 9 years. The latest fix listed for tomcat is 7.0.6.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2005-2090Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24…30 Jun 2005
  2. same family
    CVE-2008-2938Directory traversal vulnerability in Apache Tomcat 4.1.0 through…13 Aug 2008
  3. same family
    This CVECVE-2010-2227Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0…13 Jul 2010
  4. same family
    CVE-2011-3190Certain AJP protocol connector implementations in Apache Tomcat…31 Aug 2011
  5. relatedHigh

    Why these are linked:

    • Fixed one release later7.0.21 → 7.0.22 (org.apache.tomcat:tomcat)
    • Same code patched: AbstractAjpProcessor.java, AjpAprProcessor.java, AjpNioProcessor.java, AjpProcessor.java (machine-matched)Functions: processcommit a2538cecommit 9eae334
    CVE-2011-3375Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not…19 Jan 2012
  6. relatedMedium

    Why these are linked:

    CVE-2013-4286Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before…26 Feb 2014

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 6.0.24CVE-2009-290228 Jan 2010
  2. 6.0.28CVE-2010-115723 Apr 2010
  3. 6.0.35CVE-2010-431226 Nov 2010
  4. 6.0.38CVE-2014-003326 Feb 2014
  5. 7.0.2CVE-2010-222713 Jul 2010
  6. 7.0.4CVE-2010-371810 Feb 2011
  7. 7.0.5CVE-2010-417226 Nov 2010
  8. 7.0.6CVE-2011-001318 Feb 2011Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-cxg2-49rq-8gcr

Upgrade to 7.0.105 or later

Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2009-3555, CVE-2011-4858, +3).

Set the version to 7.0.105 or later in your pom.xml or build.gradle.

First fixed in 7.0.2 for CVE-2010-2227.

Affected versions, by release line

If you runUpgrade to
7.0.0 up to 7.0.27.0.105first fix for this CVE: 7.0.2
6.0.0 up to 6.0.286.0.35first fix for this CVE: 6.0.28
5.5.0 up to 5.5.305.5.35first fix for this CVE: 5.5.30

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

48 links, grouped by NVD tag

x_refsource_CONFIRM 13

novell.com/support/viewContent.do?externalId=7007274novell.com/support/viewContent.do?externalId=7007275tomcat.apache.org/security-7.htmlsvn.apache.org/viewvc?view=revision&revision=959428geronimo.apache.org/22x-security-report.htmltomcat.apache.org/security-6.htmlvmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlsvn.apache.org/viewvc?view=revision&revision=958911
Show 5 moreShow fewertomcat.apache.org/security-5.htmlvmware.com/security/advisories/VMSA-2011-0003.htmlsupport.apple.com/kb/HT5002geronimo.apache.org/21x-security-report.htmlsvn.apache.org/viewvc?view=revision&revision=958977

mailing-list 6

securityfocus.com/archive/1/512272/100/0/threadedsecurityfocus.com/archive/1/516397/100/0/threadedlists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

third-party-advisory 8

secunia.com/advisories/42079secunia.com/advisories/43310secunia.com/advisories/44183secunia.com/advisories/41025secunia.com/advisories/40813secunia.com/advisories/42368secunia.com/advisories/57126secunia.com/advisories/42454

vendor-advisory 14

debian.org/security/2011/dsa-2207marc.info/?l=bugtraq&m=136485229118404&w=2mandriva.com/security/advisories?name=MDVSA-2010:177redhat.com/support/errata/RHSA-2010-0581.htmllists.fedoraproject.org/pipermail/package-announce/2010-November/050214.htmlredhat.com/support/errata/RHSA-2010-0580.htmllists.fedoraproject.org/pipermail/package-announce/2010-November/050207.htmllists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
Show 6 moreShow fewermandriva.com/security/advisories?name=MDVSA-2010:176lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.htmlmarc.info/?l=bugtraq&m=129070310906557&w=2redhat.com/support/errata/RHSA-2010-0582.htmlmarc.info/?l=bugtraq&m=139344343412337&w=2redhat.com/support/errata/RHSA-2010-0583.html

vdb-entry 7

vupen.com/english/advisories/2010/3056securityfocus.com/bid/41544vupen.com/english/advisories/2010/1986oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18532securitytracker.com/id?1024180exchange.xforce.ibmcloud.com/vulnerabilities/60264vupen.com/english/advisories/2010/2868
↑ ↓ chooseEnter openEsc close