QwikSec

Security Database

CVE

CWE

Training

CVE-2013-4286

Published: Feb 26, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_REDHAT

third-party-advisory

x_refsource_SECUNIA

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

vendor-advisory

x_refsource_MANDRIVA

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_DEBIAN

http://tomcat.apache.org/security-7.html

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

mailing-list

x_refsource_BUGTRAQ

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

x_refsource_CONFIRM

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

vendor-advisory

x_refsource_HP

http://www-01.ibm.com/support/docview.wss?uid=swg21678113

x_refsource_CONFIRM

http://tomcat.apache.org/security-8.html

x_refsource_CONFIRM

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

x_refsource_CONFIRM

http://www-01.ibm.com/support/docview.wss?uid=swg21677147

x_refsource_CONFIRM

http://www-01.ibm.com/support/docview.wss?uid=swg21678231

x_refsource_CONFIRM

http://advisories.mageia.org/MGASA-2014-0148.html

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

http://tomcat.apache.org/security-6.html

x_refsource_CONFIRM

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_UBUNTU

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_REDHAT

http://svn.apache.org/viewvc?view=revision&revision=1521854

x_refsource_CONFIRM

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

mailing-list

x_refsource_FULLDISC

http://www-01.ibm.com/support/docview.wss?uid=swg21667883

x_refsource_CONFIRM

https://bugzilla.redhat.com/show_bug.cgi?id=1069921

x_refsource_CONFIRM

vendor-advisory

x_refsource_HP

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

x_refsource_CONFIRM

http://svn.apache.org/viewvc?view=revision&revision=1552565

x_refsource_CONFIRM

http://www-01.ibm.com/support/docview.wss?uid=swg21675886

x_refsource_CONFIRM

http://svn.apache.org/viewvc?view=revision&revision=1521829

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

third-party-advisory

x_refsource_SECUNIA

[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.