Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
www.openwall.com/lists/oss-security/2019/04/23/1 - https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html - http://www.securityfocus.com/bid/108047
CVE ID: CVE-2018-1318 State: PUBLISHED Published: 2018-08-29T13:00:00Z Last Updated: 2024-09-16T22:50:52.944Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: Information Disclosure Description: Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apache/trafficserver/pull/3195 - http://www.securityfocus.
es: - CVE Program Container: References: - https://github.com/apache/trafficserver/pull/3195 - http://www.securityfocus.com/bid/105176 - https://www.debian.org/security/2018/dsa-4282 - https://lists.apache.org/thread.html/9357cdfb6352f72944411608b712e37196ad9e4bc0f17c4828a26fb2%40%3Cusers.trafficserver.apache.org%3E
CVE ID: CVE-2018-1319 State: PUBLISHED Published: 2018-03-15T20:00:00Z Last Updated: 2024-09-17T01:41:55.447Z Vendors: Apache Software Foundation Products: Apache Allura Problem Types: HTTP response splitting Description: In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results may occur including XSS or service denial for the victim's browsing session. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/22b74bc4002091157ec2bddf9fa3b7643ffaa77aa6cb85562f0e30da%40%3Cdev.allura.apache.org%3E - http://www.securityfocus.com/bid/103434
CVE ID: CVE-2018-1320 State: PUBLISHED Published: 2019-01-07T18:00:00 Last Updated: 2024-08-05T03:59:37.833Z Vendors: Apache Software Foundation Products: Apache Thrift Problem Types: Improper Authentication Description: Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/da5234b5e78f1c99190407f791dfe1bf6c58de8d30d15974a9669b
ram Container: References: - https://lists.apache.org/thread.html/da5234b5e78f1c99190407f791dfe1bf6c58de8d30d15974a9669be3%40%3Cuser.thrift.apache.org%3E - http://www.securityfocus.com/bid/106551 - https://lists.debian.org/debian-lts-announce/2019/02/msg00008.html - https://lists.apache.org/thread.html/187684ac8b94d55256253f5220cb55e8bd568afdf9a8a86e9bbb66c9%40%3Cdevnull.infra.apache.org%3E - https://support.f5.com/csp/article/K36361684 - https://lists.apache.org/thread.html/dbe3a39b48900318ad44494e8721f786901ba4520cd412c7698f534f%40%3Cdev.storm.apache.org%3E - https://lists.apache.org/thread.html/dfee89880c84874058c6a584d8128468f8d3c2ac25068ded91073adc%40%3Cuser.storm.apache.org%3E - https:
s.apache.org/thread.html/dfee89880c84874058c6a584d8128468f8d3c2ac25068ded91073adc%40%3Cuser.storm.apache.org%3E - https://lists.apache.org/thread.html/e825ff2f4e129c0ecdb6a19030b53c1ccdf810a8980667628d0c6a80%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/07/24/3 - https://access.redhat.com/errata/RHSA-2019:2413 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/
d.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/3d3b6849fcf4cd1e87703b3dde0d57aabeb9ba0193dc0cf3c97f545d%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/6b07f6f618155c777191b4fad8ade0f0cf4ed4c12a1a746ce903d816%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/07c3cd5a2953a4b253eee4437b1397b1603d0f886437e19b657d2c54%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/8be5b16c02567fff61b1284e5df433a4e38617bc7
54%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/8be5b16c02567fff61b1284e5df433a4e38617bc7de4804402bf62be%40%3Ccommits.cassandra.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r2278846f7ab06ec07a0aa31457235e0ded9191b216cba55f3f315f16%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r261972a3b14cf6f1dcd94b1b265e9ef644a38ccdf0d0238fa0c4d459%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r09c3dcdccf4b74ad13bda79b354e
d0238fa0c4d459%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r09c3dcdccf4b74ad13bda79b354e6b793255ccfe245cca1b8cee23f5%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r3d71a6dbb063aa61ba81278fe622b20bfe7501bb3821c27695641ac3%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r1015eaadef8314daa9348aa423086a732cfeb998ceb5d42605c9b0b5%40%3Ccommits.cassandra.apache.org%3E
CVE ID: CVE-2018-1321 State: PUBLISHED Published: 2018-03-20T17:00:00Z Last Updated: 2024-09-16T18:03:42.299Z Vendors: Apache Software Foundation Products: Apache Syncope Problem Types: File read and write, remote code execution Description: An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103508 - http://syncope.apache.org/se
yst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103508 - http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements - https://www.exploit-db.com/exploits/45400/
CVE ID: CVE-2018-1322 State: PUBLISHED Published: 2018-03-20T17:00:00Z Last Updated: 2024-09-16T17:03:34.787Z Vendors: Apache Software Foundation Products: Apache Syncope Problem Types: Information disclosure Description: An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters. Additional Analyst Notes: - CVE Program Container: References: - http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting - http://www.securityfocus.com/bid/103507 - https://w
VE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting - http://www.securityfocus.com/bid/103507 - https://www.exploit-db.com/exploits/45400/
CVE ID: CVE-2018-1323 State: PUBLISHED Published: 2018-03-12T16:00:00Z Last Updated: 2024-09-17T02:16:54.351Z Vendors: Apache Software Foundation Products: Apache Tomcat Connectors Problem Types: Information Disclosure Description: The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy. A
tion functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103389 - https://access.redhat.com/errata/RHSA-2018:1843 - https://lists.apache.org/thread.html/6e146bce83578bd870893250ba8354e28f9d8e86c674c30dbeee529f%40%3Cannounce.tomcat.apache.org%3E - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/277d
977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2018-1324 State: PUBLISHED Published: 2018-03-16T13:00:00Z Last Updated: 2024-09-17T03:59:32.872Z Vendors: Apache Software Foundation Products: Apache Commons Compress Problem Types: Denial of Service Description: A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040549 - https://lists.apache.org/thread.html/1c7b6df6d1c5c8583518a0
r: References: - http://www.securitytracker.com/id/1040549 - https://lists.apache.org/thread.html/1c7b6df6d1c5c8583518a0afa017782924918e4d6acfaf23ed5b2089%40%3Cdev.commons.apache.org%3E - http://www.securityfocus.com/bid/103490 - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/r5532dc8d5456b5151e8c286801e2e5769f5c04118b29c3b5d13ea387%40%3Cissues.beam.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2018-1325 State: PUBLISHED Published: 2018-04-18T19:00:00Z Last Updated: 2024-09-16T20:52:40.880Z Vendors: Apache Software Foundation Products: wicket-jquery-ui Problem Types: XSS Description: In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display. Additional Analyst Notes: - CVE Program Container: References: - https://markmail.org/message/6bxjyaolehhq7jrl
CVE ID: CVE-2018-1326 State: REJECTED Published: 2020-01-06T15:09:45 Last Updated: 2020-01-06T15:09:45 Description: No description available.
CVE ID: CVE-2018-1327 State: PUBLISHED Published: 2018-03-27T21:00:00Z Last Updated: 2024-09-16T23:11:07.229Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: DoS attack Description: The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16. Additional Analyst Notes: -
plement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20180330-0001/ - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.securitytracker.com/id/1040575 - http://www.securityfocus.com/bid/103516 - https://cwiki.apache.org/confluence/display/WW/S2-056 - https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3%40%3Cissues.struts.apache.org%3E - https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db%40%3Cissues.struts.apache.org%3E
CVE ID: CVE-2018-1328 State: PUBLISHED Published: 2019-04-23T14:45:24 Last Updated: 2024-08-05T03:59:38.883Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: Stored XSS Description: Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph". Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/04/23/1 - https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html - http://www.securityfocus.com/bid/108047
CVE ID: CVE-2018-1329 State: REJECTED Published: 2018-08-02T13:00:00 Last Updated: 2018-08-02T12:57:01 Description: No description available.
CVE ID: CVE-2018-1330 State: PUBLISHED Published: 2018-09-13T19:00:00Z Last Updated: 2024-09-16T20:42:57.117Z Vendors: Apache Software Foundation Products: Apache Mesos Problem Types: Denial of Service Description: When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/3
ster inoperable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/395cb6bcf367702acd1e580a1f39b56cdd7a5953d0368b4c1adb1dde%40%3Cdev.mesos.apache.org%3E
CVE ID: CVE-2018-1331 State: PUBLISHED Published: 2018-07-10T17:00:00Z Last Updated: 2024-09-16T17:48:08.492Z Vendors: Apache Software Foundation Products: Apache Storm Problem Types: Remote Code Execution Description: In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user. Additional Analyst Notes: - CVE Program Container: References: - http://storm.apache.org/2018/06/04/storm122-released.html - http://www.openwall.com/lists/oss-security/2018/07/10/4 - http://storm.apache.org/2018/06/04/storm113-released.html - http://www.securit
all.com/lists/oss-security/2018/07/10/4 - http://storm.apache.org/2018/06/04/storm113-released.html - http://www.securityfocus.com/bid/104732 - http://www.securitytracker.com/id/1041273
CVE ID: CVE-2018-1332 State: PUBLISHED Published: 2018-06-05T19:00:00Z Last Updated: 2024-09-16T16:23:01.430Z Vendors: Apache Software Foundation Products: Apache Storm Problem Types: User Impersonation Description: Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/50f1d6a7af27f49d2e498a9ab2975685302cd8ca47000b7c38f339a4%40%3Cdev.storm.apache.org%3E - http://www.securityfocus.com/bid/104399
CVE ID: CVE-2018-1333 State: PUBLISHED Published: 2018-06-18T18:00:00Z Last Updated: 2024-09-17T04:09:37.340Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: (undefined) Description: By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33). Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3558 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2019:0367 - h
/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2019:0367 - https://security.netapp.com/advisory/ntap-20180926-0007/ - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333 - https://usn.ubuntu.com/3783-1/ - http://www.securitytracker.com/id/1041402 - https://access.redhat.com/errata/RHSA-2019:0366 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org
7e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3C
tpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119
3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2018-1334 State: PUBLISHED Published: 2018-07-12T13:00:00Z Last Updated: 2024-09-17T03:22:59.383Z Vendors: Apache Software Foundation Products: Apache Spark Problem Types: Information Disclosure Description: In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. Additional Analyst Notes: - CVE Program Container: References: - https://spark.apache.org/security.html#CVE-2018-1334 - https://lists.apache.org/thread.html/4d6d210e319a501b740293daaeeeadb51927111fb8261a3e4cd60060%40%3Cdev.spark.apache.org%3E
CVE ID: CVE-2018-1335 State: PUBLISHED Published: 2018-04-25T21:00:00Z Last Updated: 2024-09-17T03:58:34.667Z Vendors: Apache Software Foundation Products: Apache Tika Problem Types: Command Injection Description: From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccb
: - CVE Program Container: References: - https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca%40%3Cdev.tika.apache.org%3E - http://www.securityfocus.com/bid/104001 - https://www.exploit-db.com/exploits/46540/ - http://packetstormsecurity.com/files/153864/Apache-Tika-1.17-Header-Command-Injection.html - https://access.redhat.com/errata/RHSA-2019:3140
CVE ID: CVE-2018-1336 State: PUBLISHED Published: 2018-08-02T14:00:00Z Last Updated: 2024-11-14T20:35:47.322Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Denial of Service Description: An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://usn.ubuntu.com/3723-1/ - http://www.securityfocus.com/bid/104898 - https://access.redhat.com/errata/RHSA-2018:2740 - h
//usn.ubuntu.com/3723-1/ - http://www.securityfocus.com/bid/104898 - https://access.redhat.com/errata/RHSA-2018:2740 - https://access.redhat.com/errata/RHSA-2018:2741 - https://access.redhat.com/errata/RHSA-2018:2921 - https://access.redhat.com/errata/RHSA-2018:2742 - https://www.debian.org/security/2018/dsa-4281 - https://access.redhat.com/errata/RHSA-2018:2945 - https://access.redhat.com/errata/RHSA-2018:2939 - https://access.redhat.com/errata/RHSA-2018:2701 - https://security.netapp.com/advisory/ntap-20180817-0001/ - https://access.redhat.com/errata/RHEA-2018:2188 - http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E - ht
://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E - https://access.redhat.com/errata/RHEA-2018:2189 - https://access.redhat.com/errata/RHSA-2018:2743 - https://access.redhat.com/errata/RHSA-2018:2700 - https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html - https://access.redhat.com/errata/RHSA-2018:3768 - https://access.redhat.com/errata/RHSA-2018:2930 - http://www.securitytracker.com/id/1041375 - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551
dev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83