Denial of service in Drupal - CVE-2014-5019
Published: September 14, 2016
Vulnerability identifier: #VU447
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-5019
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause denial of service.
The weakness exists due to unsufficient checking of HTTP headers. Attackers can send specially crafted HTTP header that may make the site unavailable and cause the target service deny.
Successful exploitation of this vulnerability may lead to denial of service on the target system.
The weakness exists due to unsufficient checking of HTTP headers. Attackers can send specially crafted HTTP header that may make the site unavailable and cause the target service deny.
Successful exploitation of this vulnerability may lead to denial of service on the target system.
Affected software
Drupal
Debian Linux
Fedora
drupal7
Debian Linux
Fedora
drupal7
How to mitigate CVE-2014-5019
Update 6.x to 6.32.
https://www.drupal.org/drupal-6.32-release-notes
Update 7.x to 7.29.
https://www.drupal.org/drupal-7.29-release-notes
https://www.drupal.org/drupal-6.32-release-notes
Update 7.x to 7.29.
https://www.drupal.org/drupal-7.29-release-notes
drupal7 - addressed in versions 7.29-1.el5, 7.29-1.el6, 7.30-1.el5, 7.30-1.el6, 7.31-1.el5, 7.31-1.el6