CVE-2018-1336

Published: Aug 2, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

Affected (44)

Products: Apache: Tomcat · Canonical: Ubuntu Linux · Debian: Debian Linux · +1 more

Show all products

Apache: Tomcat · Canonical: Ubuntu Linux · Debian: Debian Linux · Redhat: Jboss Enterprise Application Platform, Jboss Enterprise Web Server, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation

1 product

1 product

1 product

5 products

Jboss Enterprise Application Platform

Jboss Enterprise Web Server

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 7.0.28 to 7.0.86
Apache Tomcat	From 8.0.0 to 8.0.51
Apache Tomcat	From 8.5.0 to 8.5.30
Apache Tomcat	From 9.0.1 to 9.0.7
Apache Tomcat	Version 8.0.0 rc10
Apache Tomcat	Version 8.0.0 rc1
Apache Tomcat	Version 8.0.0 rc2
Apache Tomcat	Version 8.0.0 rc3
Apache Tomcat	Version 8.0.0 rc4
Apache Tomcat	Version 8.0.0 rc5
Apache Tomcat	Version 8.0.0 rc6
Apache Tomcat	Version 8.0.0 rc7
Apache Tomcat	Version 8.0.0 rc8
Apache Tomcat	Version 8.0.0 rc9
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone22
Apache Tomcat	Version 9.0.0 milestone23
Apache Tomcat	Version 9.0.0 milestone24
Apache Tomcat	Version 9.0.0 milestone25
Apache Tomcat	Version 9.0.0 milestone26
Apache Tomcat	Version 9.0.0 milestone27
Apache Tomcat	Version 9.0.0 milestone9

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 6.4.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Web Server	Version 3.0.0

Configuration D

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Web Server	Version 5.0.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 7.0

Related CWEs

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (76)

http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

http://www.securityfocus.com/bid/104898

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1041375

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHEA-2018:2188

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHEA-2018:2189

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2700

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2701

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2740

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2741

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2742

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2743

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2921

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2930

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2939

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2945

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3768

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20180817-0001/

Source: security@apache.org

Third Party Advisory

https://support.f5.com/csp/article/K73008537?utm_source=f5support&amp%3Butm_medium=RSS

Source: security@apache.org

https://usn.ubuntu.com/3723-1/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4281

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: security@apache.org

http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E