CVE-2014-0119
medium
CVSS v3
—
CVSS v2
4.3
VIR risk
4.3
Description
Missing XML Validation in Apache Tomcat
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: secalert@redhat.com — http://tomcat.apache.org/security-8.html
Vendor advisory: secalert@redhat.com — http://tomcat.apache.org/security-7.html
Vendor advisory: secalert@redhat.com — http://tomcat.apache.org/security-6.html
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2014-0119.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | <6.0.40 | 6.0.40 |
| Maven | org.apache.tomcat:tomcat | >=7.0.0,<7.0.54 | 7.0.54 |
| Maven | org.apache.tomcat:tomcat | >=8.0.0,<8.0.6 | 8.0.6 |
| Maven | org.apache.tomcat:tomcat-catalina | <6.0.40 | 6.0.40 |
| Maven | org.apache.tomcat:tomcat-catalina | >=7.0.0,<7.0.54 | 7.0.54 |
| Maven | org.apache.tomcat:tomcat-catalina | >=8.0.0,<8.0.6 | 8.0.6 |
| Maven | org.apache.tomcat:tomcat-jasper | <6.0.40 | 6.0.40 |
| Maven | org.apache.tomcat:tomcat-jasper | >=7.0.0,<7.0.54 | 7.0.54 |
| Maven | org.apache.tomcat:tomcat-jasper | >=8.0.0,<8.0.6 | 8.0.6 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| apache | tomcat | 8.0.0 | |
| apache | tomcat | 8.0.1 | |
| apache | tomcat | 8.0.3 | |
| apache | tomcat | 8.0.5 | |
| apache | tomcat | {"endIncluding":"6.0.39"} | |
| apache | tomcat | 6 | |
| apache | tomcat | 6.0 | |
| apache | tomcat | 6.0.0 | |
| apache | tomcat | 6.0.1 | |
| apache | tomcat | 6.0.2 | |
| apache | tomcat | 6.0.3 | |
| apache | tomcat | 6.0.4 | |
| apache | tomcat | 6.0.5 | |
| apache | tomcat | 6.0.6 | |
| apache | tomcat | 6.0.7 | |
| apache | tomcat | 6.0.8 | |
| apache | tomcat | 6.0.9 | |
| apache | tomcat | 6.0.10 | |
| apache | tomcat | 6.0.11 | |
| apache | tomcat | 6.0.12 | |
| apache | tomcat | 6.0.13 | |
| apache | tomcat | 6.0.14 | |
| apache | tomcat | 6.0.15 | |
| apache | tomcat | 6.0.16 | |
| apache | tomcat | 6.0.17 | |
| apache | tomcat | 6.0.18 | |
| apache | tomcat | 6.0.19 | |
| apache | tomcat | 6.0.20 | |
| apache | tomcat | 6.0.24 | |
| apache | tomcat | 6.0.26 | |
| apache | tomcat | 6.0.27 | |
| apache | tomcat | 6.0.28 | |
| apache | tomcat | 6.0.29 | |
| apache | tomcat | 6.0.30 | |
| apache | tomcat | 6.0.31 | |
| apache | tomcat | 6.0.32 | |
| apache | tomcat | 6.0.33 | |
| apache | tomcat | 6.0.35 | |
| apache | tomcat | 6.0.36 | |
| apache | tomcat | 6.0.37 | |
| apache | tomcat | 7.0.0 | |
| apache | tomcat | 7.0.1 | |
| apache | tomcat | 7.0.2 | |
| apache | tomcat | 7.0.3 | |
| apache | tomcat | 7.0.4 | |
| apache | tomcat | 7.0.5 | |
| apache | tomcat | 7.0.6 | |
| apache | tomcat | 7.0.7 | |
| apache | tomcat | 7.0.8 | |
| apache | tomcat | 7.0.9 | |
| apache | tomcat | 7.0.10 | |
| apache | tomcat | 7.0.11 | |
| apache | tomcat | 7.0.12 | |
| apache | tomcat | 7.0.13 | |
| apache | tomcat | 7.0.14 | |
| apache | tomcat | 7.0.15 | |
| apache | tomcat | 7.0.16 | |
| apache | tomcat | 7.0.17 | |
| apache | tomcat | 7.0.18 | |
| apache | tomcat | 7.0.19 | |
| apache | tomcat | 7.0.20 | |
| apache | tomcat | 7.0.21 | |
| apache | tomcat | 7.0.22 | |
| apache | tomcat | 7.0.23 | |
| apache | tomcat | 7.0.24 | |
| apache | tomcat | 7.0.25 | |
| apache | tomcat | 7.0.26 | |
| apache | tomcat | 7.0.27 | |
| apache | tomcat | 7.0.28 | |
| apache | tomcat | 7.0.29 | |
| apache | tomcat | 7.0.30 | |
| apache | tomcat | 7.0.31 | |
| apache | tomcat | 7.0.32 | |
| apache | tomcat | 7.0.33 | |
| apache | tomcat | 7.0.34 | |
| apache | tomcat | 7.0.35 | |
| apache | tomcat | 7.0.36 | |
| apache | tomcat | 7.0.37 | |
| apache | tomcat | 7.0.38 | |
| apache | tomcat | 7.0.39 | |
| apache | tomcat | 7.0.40 | |
| apache | tomcat | 7.0.41 | |
| apache | tomcat | 7.0.42 | |
| apache | tomcat | 7.0.43 | |
| apache | tomcat | 7.0.44 | |
| apache | tomcat | 7.0.45 | |
| apache | tomcat | 7.0.46 | |
| apache | tomcat | 7.0.47 | |
| apache | tomcat | 7.0.48 | |
| apache | tomcat | 7.0.49 | |
| apache | tomcat | 7.0.50 | |
| apache | tomcat | 7.0.52 | |
| apache | tomcat | 7.0.53 | |
References
- https://www.suse.com/security/cve/CVE-2014-0119.html
- http://advisories.mageia.org/MGASA-2014-0268.html
- http://marc.info/?l=bugtraq&m=141017844705317&w=2
- http://marc.info/?l=bugtraq&m=144498216801440&w=2
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://seclists.org/fulldisclosure/2014/May/141
- http://secunia.com/advisories/59732
- http://secunia.com/advisories/59873
- http://secunia.com/advisories/60729
- http://svn.apache.org/viewvc?view=revision&revision=1588193
- http://svn.apache.org/viewvc?view=revision&revision=1588199
- http://svn.apache.org/viewvc?view=revision&revision=1589640
- http://svn.apache.org/viewvc?view=revision&revision=1589837
- http://svn.apache.org/viewvc?view=revision&revision=1589980
- http://svn.apache.org/viewvc?view=revision&revision=1589983
- http://svn.apache.org/viewvc?view=revision&revision=1589985
- http://svn.apache.org/viewvc?view=revision&revision=1589990
- http://svn.apache.org/viewvc?view=revision&revision=1589992
- http://svn.apache.org/viewvc?view=revision&revision=1589997
- http://svn.apache.org/viewvc?view=revision&revision=1590028
- http://svn.apache.org/viewvc?view=revision&revision=1590036
- http://svn.apache.org/viewvc?view=revision&revision=1593815
CWEs
CWE-264
Verify integrity in audit chain (admin only). AS-IS.