hash table collisions CPU usage DoS (oCERT-2011-003)
CVE: CVE-2011-4858
Component: tomcat
Severity: Moderate
Release date: 2011-12-28T00:00:00+00:00

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Users of Tomcat should upgrade to these updated packages, which
resolve these issues. Tomcat must be restarted for this update to take
effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains download links (you must
log in to download the update).

The JBoss server process must be restarted for this update to take effect.
For users of JBoss Enterprise BRMS Platform and JBoss Enterprise SOA
Platform, it is recommend to halt the server by stopping the JBoss
Application Server process before installing this update, and then after
installing the update, restart the server by starting the JBoss Application
Server process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Application Platform installation (including all
applications and configuration files).

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update).

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss ON installation (including its databases, applications,
configuration files, the JBoss ON server's file system directory, and so
on).

Refer to the JBoss Operations Network 3.0.1 Release Notes for installation
information.
The References section of this erratum contains a download link (you must
log in to download the update).

The JBoss server process must be restarted for this update to take effect.
Note that if you have created custom applications that are packaged with a
copy of the JBoss Seam 2 library, those applications must be rebuilt with
the updated jboss-seam.jar file provided by this update.
The References section of this erratum contains a download link (you must
log in to download the update).

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Web Server installation (including all
applications and configuration files).

Tomcat must be restarted for this update to take effect.