This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2014-0050 →

DEBIAN-CVE-2014-0050

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to ca...

Original description

The description as published by the source.

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libcommons-fileupload-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]

Debian:13 libcommons-fileupload-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]

Debian:14 libcommons-fileupload-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]

References

advisory security-tracker.debian.org