CVE-2018-1336
HIGH severity · CVSS 7.5 · CWE-835
7.5CVSS HIGH
Summary
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit probability (EPSS)21%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3EAdvisory
- http://www.securityfocus.com/bid/104898Advisory
- http://www.securitytracker.com/id/1041375Advisory
- https://access.redhat.com/errata/RHEA-2018:2188Advisory
- https://access.redhat.com/errata/RHEA-2018:2189Advisory
- https://access.redhat.com/errata/RHSA-2018:2700Advisory
- https://access.redhat.com/errata/RHSA-2018:2701Advisory
- https://access.redhat.com/errata/RHSA-2018:2740Advisory