You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Michal Vyskocil <mv...@suse.cz> on 2008/01/28 16:59:06 UTC
Where's the fix of CVE-2005-2090?
Hi,
I'm unable to locate a patch to fix the CVE-2005-2090. I cannot found any hint
from svn commit log or bugzilla.
According http://tomcat.apache.org/security-5.html is this issue fixed in
5.5.23, so I've downloaded the 5.5.20 and a 5.5.23 from archive.apache.org
and use a diff -ru on unpacked source code to locate that.
Maybe is this commit
------------------------------------------------------------------------
r513079 | markt | 2007-03-01 01:26:12 +0100 (Čt, 01 bře 2007) | 1 line
As per RFC2616, requests with multiple content-length headers are invalid.
Index: coyote/src/java/org/apache/coyote/Request.java
===================================================================
--- coyote/src/java/org/apache/coyote/Request.java (revision 511952)
+++ coyote/src/java/org/apache/coyote/Request.java (revision 513079)
@@ -294,7 +294,7 @@
public long getContentLengthLong() {
if( contentLength > -1 ) return contentLength;
- MessageBytes clB = headers.getValue("content-length");
+ MessageBytes clB = headers.getUniqueValue("content-length");
contentLength = (clB == null || clB.isNull()) ? -1 : clB.getLong();
return contentLength;
...
is that, but I'm no sure.
Anyone could help?
Regards
Michal Vyskocil
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Where's the fix of CVE-2005-2090?
Posted by Mark Thomas <ma...@apache.org>.
Filip Hanik - Dev Lists wrote:
> Mark Thomas wrote:
>> Michal Vyskocil wrote:
>>> I'm unable to locate a patch to fix the CVE-2005-2090. I cannot found
>>> any hint from svn commit log or bugzilla.
>>>
>>> Maybe is this commit
>>> ------------------------------------------------------------------------
>>> r513079 | markt | 2007-03-01 01:26:12 +0100 (Čt, 01 bře 2007) | 1 line
>>>
>>> As per RFC2616, requests with multiple content-length headers are
>>> invalid.
>>
>> Yep, that's it.
> isn't it documented incorrectly then?, we dont return 400, we just grab
> one of the headers.
If you look at the code for MimeHeaders.getUniqueValue() you'll see that
the code throws an IAE if multiple values are found in the headers.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Where's the fix of CVE-2005-2090?
Posted by Filip Hanik - Dev Lists <de...@hanik.com>.
Mark Thomas wrote:
> Michal Vyskocil wrote:
>> I'm unable to locate a patch to fix the CVE-2005-2090. I cannot found
>> any hint from svn commit log or bugzilla.
>>
>> Maybe is this commit
>> ------------------------------------------------------------------------
>> r513079 | markt | 2007-03-01 01:26:12 +0100 (Čt, 01 bře 2007) | 1 line
>>
>> As per RFC2616, requests with multiple content-length headers are
>> invalid.
>
> Yep, that's it.
isn't it documented incorrectly then?, we dont return 400, we just grab
one of the headers.
filip
>
> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Where's the fix of CVE-2005-2090?
Posted by Michal Vyskocil <mv...@suse.cz>.
On Monday 28 January 2008 21:09:31 Mark Thomas wrote:
> Michal Vyskocil wrote:
> > I'm unable to locate a patch to fix the CVE-2005-2090. I cannot found any
> > hint from svn commit log or bugzilla.
> >
> > Maybe is this commit
> > ------------------------------------------------------------------------
> > r513079 | markt | 2007-03-01 01:26:12 +0100 (Čt, 01 bře 2007) | 1 line
> >
> > As per RFC2616, requests with multiple content-length headers are
> > invalid.
>
> Yep, that's it.
>
> Mark
Thanks for your help, Mark.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Where's the fix of CVE-2005-2090?
Posted by Mark Thomas <ma...@apache.org>.
Michal Vyskocil wrote:
> I'm unable to locate a patch to fix the CVE-2005-2090. I cannot found any hint
> from svn commit log or bugzilla.
>
> Maybe is this commit
> ------------------------------------------------------------------------
> r513079 | markt | 2007-03-01 01:26:12 +0100 (Čt, 01 bře 2007) | 1 line
>
> As per RFC2616, requests with multiple content-length headers are invalid.
Yep, that's it.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org