{"id":"GHSA-wr3m-gw98-mc3j","summary":"Improper Input Validation in Apache Tomcat","details":"Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","aliases":["CVE-2011-4858"],"modified":"2023-11-01T04:44:36.604208Z","published":"2022-05-14T03:52:45Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2022-07-13T18:25:49Z","nvd_published_at":"2012-01-05T19:55:00Z","cwe_ids":["CWE-20"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4858"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=750521"},{"type":"WEB","url":"https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py"},{"type":"PACKAGE","url":"https://github.com/apache/tomcat"},{"type":"WEB","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886"},{"type":"WEB","url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106@apache.org%3e"},{"type":"WEB","url":"http://marc.info/?l=bugtraq&m=132871655717248&w=2"},{"type":"WEB","url":"http://marc.info/?l=bugtraq&m=133294394108746&w=2"},{"type":"WEB","url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2012-0074.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2012-0075.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2012-0076.html"},{"type":"WEB","url":"http://tomcat.apache.org/tomcat-7.0-doc/changelog.html"},{"type":"WEB","url":"http://www.debian.org/security/2012/dsa-2401"},{"type":"WEB","url":"http://www.kb.cert.org/vuls/id/903934"},{"type":"WEB","url":"http://www.nruns.com/_downloads/advisory28122011.pdf"},{"type":"WEB","url":"http://www.ocert.org/advisories/ocert-2011-003.html"}],"affected":[{"package":{"name":"org.apache.tomcat:tomcat","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat/tomcat"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.35"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wr3m-gw98-mc3j/GHSA-wr3m-gw98-mc3j.json"}},{"package":{"name":"org.apache.tomcat:tomcat","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat/tomcat"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.35"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wr3m-gw98-mc3j/GHSA-wr3m-gw98-mc3j.json"}},{"package":{"name":"org.apache.tomcat:tomcat","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat/tomcat"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.23"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wr3m-gw98-mc3j/GHSA-wr3m-gw98-mc3j.json"}}],"schema_version":"1.9.0"}