GHSA-fvm3-cfvj-gxqq

Source

https://github.com/advisories/GHSA-fvm3-cfvj-gxqq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/12/GHSA-fvm3-cfvj-gxqq/GHSA-fvm3-cfvj-gxqq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fvm3-cfvj-gxqq

Aliases

CVE-2016-3092

Published

2018-12-21T17:47:47Z

Modified

2024-03-16T05:19:58.144642Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

High severity vulnerability that affects commons-fileupload:commons-fileupload

Details

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

Database specific

{
    "nvd_published_at": "2016-07-04T22:59:00Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:35:21Z"
}

References

Affected packages

Maven / commons-fileupload:commons-fileupload

Package

Name: commons-fileupload:commons-fileupload; View open source insights on deps.dev
Purl: pkg:maven/commons-fileupload/commons-fileupload

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.2

Affected versions

1.*

1.0-beta-1

1.0-rc1

1.0

1.1

1.1.1

1.2

1.2.1

1.2.2

1.3

1.3.1

1.3.1-jenkins-1

1.3.1-jenkins-2