Infinite loop in Apache Tomcat - CVE-2018-1336

Vulnerability identifier: #VU13986

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1336

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to improper handing of overflow in the UTF-8 decoder with supplementary characters. A remote attacker can send trigger an infinite loop in the decoder and cause the service to crash.

Apache Tomcat
JBoss Enterprise Web Server
Amazon Linux AMI
Debian Linux
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
Opensuse
Dell Support Assist Enterprise
EMC Cloud Tiering Appliance
JBoss Enterprise Application Platform
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

The vulnerability is addressed in the versions 7.0.88, 8.0.52, 8.5.31, 9.0.8.

Apache Tomcat - addressed in versions 7.0.88, 8.0.52, 8.5.31, 9.0.8
Dell Support Assist Enterprise - update to 4.00.06.00
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
EMC Cloud Tiering Appliance - addressed in versions 13.0.0.2.29, 13.1.0.2.20

• https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.88
• https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.52
• https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.31
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.8

• Denial of service in Apache Tomcat
• Red Hat update for Apache Tomcat
• Red Hat update for Apache Tomcat
• Amazon Linux AMI update for tomcat8
• Amazon Linux AMI update for tomcat7, tomcat80
• Debian update for tomcat8
• OpenSUSE Linux update for tomcat
• Red Hat update for apache tomcat
• OpenSUSE Linux update for tomcat
• Red Hat update for Red Hat JBoss Enterprise Application Platform 6.4.21
• Red Hat update for Red Hat JBoss Enterprise Application Platform 6.4.21
• Red Hat update for Red Hat JBoss Enterprise Application Platform 6.4.21
• Multiple vulnerabilities in Dell EMC Cloud Tiering Appliance
• Multiple vulnerabilities in Dell EMC Unity Family
• Multiple vulnerabilities in Dell Support Assist Enterprise