| Package | Affected versions | Patched versions |
|---|---|---|
| commons-fileupload:commons-fileupload | < 1.3.1 | 1.3.1 |
| org.apache.tomcat:tomcat | ≥ 7.0.0, < 7.0.52≥ 8.0.0-RC1, < 8.0.3 | 7.0.528.0.3 |
| commons fileupload | = 1.0= 1.1= 1.1.1= 1.2= 1.2.1= 1.2.2≤ 1.3 | |
| tomcat | = 7.0.0= 7.0.1= 7.0.10= 7.0.11= 7.0.12= 7.0.13= 7.0.14= 7.0.15= 7.0.16= 7.0.17= 7.0.18= 7.0.19= 7.0.2= 7.0.20= 7.0.21= 7.0.22= 7.0.23= 7.0.24= 7.0.25= 7.0.26= 7.0.27= 7.0.28= 7.0.29= 7.0.3= 7.0.30= 7.0.31= 7.0.32= 7.0.33= 7.0.34= 7.0.35= 7.0.36= 7.0.37= 7.0.38= 7.0.39= 7.0.4= 7.0.40= 7.0.41= 7.0.42= 7.0.43= 7.0.44= 7.0.45= 7.0.46= 7.0.47= 7.0.48= 7.0.49= 7.0.5= 7.0.50= 7.0.6= 7.0.7= 7.0.8= 7.0.9= 8.0.0= 8.0.1 | |
| retail applications | = 12.0= 12.0in= 13.0= 13.1= 13.2= 13.3= 13.4= 14.0 |
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free