Homepage

org.apache.tomcat:tomcat-coyote@7.0.91 vulnerabilities

  • latest version

    11.0.8

  • latest non vulnerable version

    11.0.8

  • first published

    14 years ago

  • latest version published

    28 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.apache.tomcat:tomcat-coyote package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Insufficient Session Expiration

    org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

    Affected versions of this package are vulnerable to Insufficient Session Expiration due to an infinite timeout being assigned to an open connection improperly, in http2/Stream.java. An attacker can force this situation by sending an HTTP/2 stream with excessive headers, causing an out-of-memory error or exhausting maxConnections.

    How to fix Insufficient Session Expiration?

    Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.90, 10.1.25, 11.0.0-M21 or higher.

    [,9.0.90)[10.1.0-M1,10.1.25)[11.0.0-M1,11.0.0-M21)
    • H
    Denial of Service (DoS)

    org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

    Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.

    How to fix Denial of Service (DoS)?

    Upgrade org.apache.tomcat:tomcat-coyote to version 8.5.94, 9.0.81, 10.1.14, 11.0.0-M12 or higher.

    [,8.5.94)[9.0.0,9.0.81)[10.0.0,10.1.14)[11.0.0-M3,11.0.0-M12)
    • H
    Arbitrary File Upload

    org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

    Affected versions of this package are vulnerable to Arbitrary File Upload. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).

    How to fix Arbitrary File Upload?

    Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.31, 8.5.51, 7.0.100 or higher.

    [9.0.0,9.0.31)[8.0.0,8.5.51)[,7.0.100)
    Go back to all versions of this package