NVD Vulnerability Detail

CVE-2014-0050

Summary	MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Publication Date	April 1, 2014, 3:27 p.m.
Registration Date	Jan. 26, 2021, 3:03 p.m.
Last Update	Nov. 21, 2024, 11:01 a.m.

CVSS2.0 : HIGH
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:retail_applications:12.0in:::::::*
cpe:2.3:a:oracle:retail_applications:13.0:::::::*
cpe:2.3:a:oracle:retail_applications:13.3:::::::*
cpe:2.3:a:oracle:retail_applications:13.2:::::::*
cpe:2.3:a:oracle:retail_applications:12.0:::::::*
cpe:2.3:a:oracle:retail_applications:14.0:::::::*
cpe:2.3:a:oracle:retail_applications:13.1:::::::*
cpe:2.3:a:oracle:retail_applications:13.4:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:7.0.49:::::::*
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:7.0.34:::::::*
cpe:2.3:a:apache:tomcat:7.0.8:::::::*
cpe:2.3:a:apache:tomcat:7.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.39:::::::*
cpe:2.3:a:apache:tomcat:7.0.26:::::::*
cpe:2.3:a:apache:tomcat:7.0.46:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:8.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.50:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:commons_fileupload:1.1:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc2::::::
cpe:2.3:a:apache:tomcat:7.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.48:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc1::::::
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:7.0.44:::::::*
cpe:2.3:a:apache:tomcat:7.0.7:::::::*
cpe:2.3:a:apache:tomcat:7.0.42:::::::*
cpe:2.3:a:apache:tomcat:7.0.37:::::::*
cpe:2.3:a:apache:tomcat:7.0.29:::::::*
cpe:2.3:a:apache:tomcat:7.0.45:::::::*
cpe:2.3:a:apache:commons_fileupload::::::::		1.3
cpe:2.3:a:apache:tomcat:8.0.0:rc10::::::
cpe:2.3:a:apache:tomcat:7.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.47:::::::*
cpe:2.3:a:apache:tomcat:7.0.41:::::::*
cpe:2.3:a:apache:tomcat:7.0.31:::::::*
cpe:2.3:a:apache:tomcat:7.0.30:::::::*
cpe:2.3:a:apache:tomcat:7.0.15:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:commons_fileupload:1.1.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.36:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.35:::::::*
cpe:2.3:a:apache:tomcat:7.0.43:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc5::::::
cpe:2.3:a:apache:tomcat:7.0.32:::::::*
cpe:2.3:a:apache:tomcat:7.0.38:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.27:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.24:::::::*
cpe:2.3:a:apache:tomcat:7.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.40:::::::*
cpe:2.3:a:apache:tomcat:7.0.9:::::::*
cpe:2.3:a:apache:commons_fileupload:1.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.3:::::::*
cpe:2.3:a:apache:tomcat:7.0.33:::::::*

Related information, measures and tools

No	URL	タグ
1	http://advisories.mageia.org/MGASA-2014-0110.html
2	http://advisories.mageia.org/MGASA-2014-0110.html
3	http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html	Exploit
4	http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html	Exploit
5	http://jvn.jp/en/jp/JVN14876762/index.html
6	http://jvn.jp/en/jp/JVN14876762/index.html
7	http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017
8	http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017
9	http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
10	http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
11	http://marc.info/?l=bugtraq&m=143136844732487&w=2
12	http://marc.info/?l=bugtraq&m=143136844732487&w=2
13	http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
14	http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
15	http://rhn.redhat.com/errata/RHSA-2014-0252.html
16	http://rhn.redhat.com/errata/RHSA-2014-0252.html
17	http://rhn.redhat.com/errata/RHSA-2014-0253.html
18	http://rhn.redhat.com/errata/RHSA-2014-0253.html
19	http://rhn.redhat.com/errata/RHSA-2014-0400.html
20	http://rhn.redhat.com/errata/RHSA-2014-0400.html
21	http://seclists.org/fulldisclosure/2014/Dec/23
22	http://seclists.org/fulldisclosure/2014/Dec/23
23	http://secunia.com/advisories/57915
24	http://secunia.com/advisories/57915
25	http://secunia.com/advisories/58075
26	http://secunia.com/advisories/58075
27	http://secunia.com/advisories/58976
28	http://secunia.com/advisories/58976
29	http://secunia.com/advisories/59039
30	http://secunia.com/advisories/59039
31	http://secunia.com/advisories/59041
32	http://secunia.com/advisories/59041
33	http://secunia.com/advisories/59183
34	http://secunia.com/advisories/59183
35	http://secunia.com/advisories/59184
36	http://secunia.com/advisories/59184
37	http://secunia.com/advisories/59185
38	http://secunia.com/advisories/59185
39	http://secunia.com/advisories/59187
40	http://secunia.com/advisories/59187
41	http://secunia.com/advisories/59232
42	http://secunia.com/advisories/59232
43	http://secunia.com/advisories/59399
44	http://secunia.com/advisories/59399
45	http://secunia.com/advisories/59492
46	http://secunia.com/advisories/59492
47	http://secunia.com/advisories/59500
48	http://secunia.com/advisories/59500
49	http://secunia.com/advisories/59725
50	http://secunia.com/advisories/59725
51	http://secunia.com/advisories/60475
52	http://secunia.com/advisories/60475
53	http://secunia.com/advisories/60753
54	http://secunia.com/advisories/60753
55	http://svn.apache.org/r1565143	Patch
56	http://svn.apache.org/r1565143	Patch
57	http://tomcat.apache.org/security-7.html	Patch Vendor Advisory
58	http://tomcat.apache.org/security-7.html	Patch Vendor Advisory
59	http://tomcat.apache.org/security-8.html	Patch Vendor Advisory
60	http://tomcat.apache.org/security-8.html	Patch Vendor Advisory
61	http://www.debian.org/security/2014/dsa-2856
62	http://www.debian.org/security/2014/dsa-2856
63	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
64	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
65	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
66	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
67	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
68	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
69	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
70	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
71	http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
72	http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
73	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
74	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
75	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
76	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
77	http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
78	http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
79	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
80	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
81	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
82	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
83	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
84	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
85	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
86	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
87	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
88	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
89	http://www.securityfocus.com/archive/1/532549/100/0/threaded
90	http://www.securityfocus.com/archive/1/532549/100/0/threaded
91	http://www.securityfocus.com/archive/1/534161/100/0/threaded
92	http://www.securityfocus.com/archive/1/534161/100/0/threaded
93	http://www.securityfocus.com/bid/65400
94	http://www.securityfocus.com/bid/65400
95	http://www.ubuntu.com/usn/USN-2130-1
96	http://www.ubuntu.com/usn/USN-2130-1
97	http://www.vmware.com/security/advisories/VMSA-2014-0007.html
98	http://www.vmware.com/security/advisories/VMSA-2014-0007.html
99	http://www.vmware.com/security/advisories/VMSA-2014-0008.html
100	http://www.vmware.com/security/advisories/VMSA-2014-0008.html
101	http://www.vmware.com/security/advisories/VMSA-2014-0012.html
102	http://www.vmware.com/security/advisories/VMSA-2014-0012.html
103	http://www-01.ibm.com/support/docview.wss?uid=swg21669554
104	http://www-01.ibm.com/support/docview.wss?uid=swg21669554
105	http://www-01.ibm.com/support/docview.wss?uid=swg21675432
106	http://www-01.ibm.com/support/docview.wss?uid=swg21675432
107	http://www-01.ibm.com/support/docview.wss?uid=swg21676091
108	http://www-01.ibm.com/support/docview.wss?uid=swg21676091
109	http://www-01.ibm.com/support/docview.wss?uid=swg21676092
110	http://www-01.ibm.com/support/docview.wss?uid=swg21676092
111	http://www-01.ibm.com/support/docview.wss?uid=swg21676401
112	http://www-01.ibm.com/support/docview.wss?uid=swg21676401
113	http://www-01.ibm.com/support/docview.wss?uid=swg21676403
114	http://www-01.ibm.com/support/docview.wss?uid=swg21676403
115	http://www-01.ibm.com/support/docview.wss?uid=swg21676405
116	http://www-01.ibm.com/support/docview.wss?uid=swg21676405
117	http://www-01.ibm.com/support/docview.wss?uid=swg21676410
118	http://www-01.ibm.com/support/docview.wss?uid=swg21676410
119	http://www-01.ibm.com/support/docview.wss?uid=swg21676656
120	http://www-01.ibm.com/support/docview.wss?uid=swg21676656
121	http://www-01.ibm.com/support/docview.wss?uid=swg21676853
122	http://www-01.ibm.com/support/docview.wss?uid=swg21676853
123	http://www-01.ibm.com/support/docview.wss?uid=swg21677691
124	http://www-01.ibm.com/support/docview.wss?uid=swg21677691
125	http://www-01.ibm.com/support/docview.wss?uid=swg21677724
126	http://www-01.ibm.com/support/docview.wss?uid=swg21677724
127	http://www-01.ibm.com/support/docview.wss?uid=swg21681214
128	http://www-01.ibm.com/support/docview.wss?uid=swg21681214
129	https://bugzilla.redhat.com/show_bug.cgi?id=1062337
130	https://bugzilla.redhat.com/show_bug.cgi?id=1062337
131	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
132	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
133	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
134	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
135	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
136	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
137	https://security.gentoo.org/glsa/202107-39
138	https://security.gentoo.org/glsa/202107-39

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Apache Commons FileUpload におけるサービス運用妨害 (DoS) の脆弱性

Title	Apache Commons FileUpload におけるサービス運用妨害 (DoS) の脆弱性
Summary	Apache Commons FileUpload には、サービス運用妨害 (DoS) の脆弱性が存在します。 Apache Software Foundation が提供する Apache Commons FileUpload には、マルチパートリクエストの処理に問題があり、当該処理が無限ループになる脆弱性が存在します。 [2014年2月12日 - 追記] JPCERT/CC では、攻撃ツールが公開されていることを確認しています。この脆弱性情報は、情報セキュリティ早期警戒パートナーシップに基づき下記の方が IPA に報告し、JPCERT/CC が開発者との調整を行いました。報告者: Hitachi Incident Response Team (HIRT)
Possible impacts	細工されたリクエストを処理すると、対象のシステムを応答不能な状態にされる可能性があります。
Solution	[アップデートする] 本脆弱性を修正した各製品のアップデートが公開されました。開発者の提供する情報をもとに、最新版にアップデートしてください。　* Apache Commons FileUpload 1.3.1 　　http://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi 　* Apache Tomcat 8.0.3 　　http://www.apache.org/dist/tomcat/tomcat-8/v8.0.3/ 　* Apache Tomcat 7.0.52 　　http://www.apache.org/dist/tomcat/tomcat-7/v7.0.52/ 　* Apache Struts 2.3.16.1 　　http://struts.apache.org/download.cgi#struts23161 [パッチを適用する] 開発者のリポジトリでは、本脆弱性の修正コードが公開されています。　* Apache Commons FileUpload: http://svn.apache.org/r1565143 　* Apache Tomcat 8: http://svn.apache.org/r1565163 　* Apache Tomcat 7: http://svn.apache.org/r1565169 [ワークアラウンドを実施する] 以下の回避策を実施することで、本脆弱性の影響を軽減することが可能です。　* Content-Type ヘッダのサイズを 4091 バイト未満に制限する詳しくは、開発者が提供する情報をご確認ください。
Publication Date	Feb. 10, 2014, midnight
Registration Date	Feb. 10, 2014, 2:01 p.m.
Last Update	Nov. 22, 2016, 4 p.m.

Affected System

Apache Software Foundation

Apache Tomcat 7.0.0 から 7.0.50 まで

Apache Tomcat 8.0.0-RC1 から 8.0.1 まで

Commons FileUpload 1.0 から 1.3 まで

Commons FileUpload に依存するその他の Apache 製品

オラクル

Application Express 4.2.6 未満

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 2.2.2

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 2.3

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 2.4

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 3.0

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 3.1

Oracle Fusion Middleware の Oracle Enterprise Data Quality 8.1.2

Oracle Fusion Middleware の Oracle Enterprise Data Quality 9.0.11

Oracle Fusion Middleware の Oracle JDeveloper 10.1.3.5

Oracle Fusion Middleware の Oracle JDeveloper 11.1.1.7

Oracle Fusion Middleware の Oracle JDeveloper 11.1.2.4

Oracle Fusion Middleware の Oracle JDeveloper 12.1.2.0

Oracle Fusion Middleware の Oracle JDeveloper 12.1.3.0

Oracle Health Sciences Applications の Oracle Health Sciences Empirica Inspections 1.0.1.0 およびそれ以前

Oracle Health Sciences Applications の Oracle Health Sciences Empirica Signal 7.3.3.3 およびそれ以前

Oracle Health Sciences Applications の Oracle Health Sciences Empirica Study 3.1.2.0 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-0050	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050
National Vulnerability Database (NVD)
2	CVE-2014-0050	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0050

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Apache Software Foundation
1	Download Apache Commons FileUpload -- Apache Commons FileUpload 1.3.1	http://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi
2	www-announce mailing list archives -- CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS	http://mail-archives.us.apache.org/mod_mbox/www-announce/201402.mbox/%3C52F373FC.9030907@apache.org%3E
Apache Struts
3	Struts 2.3.16.1	http://struts.apache.org/download.cgi#struts23161
Apache Struts Announcements
4	21 February 2014 - Immediately upgrade commons-fileupload to version 1.3.1	http://struts.apache.org/announce.html#a20140221
Apache Tomcat
5	Apache Tomcat 7.0.52	http://www.apache.org/dist/tomcat/tomcat-7/v7.0.52/
6	Apache Tomcat 8.0.3	http://www.apache.org/dist/tomcat/tomcat-8/v8.0.3/
7	Fixed in Apache Tomcat 7.0.51	http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.51
8	Fixed in Apache Tomcat 8.0.2	http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.2
Apache-SVN
9	Apache Commons FileUpload 1.3.1 RELEASE NOTES	http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/RELEASE-NOTES.txt?view=markup&pathrev=1565338
10	[Apache-SVN] Revision 1565143	http://svn.apache.org/viewvc?view=revision&revision=r1565143
Hitachi Software Vulnerability Information
11	HS14-008	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-008/index.html
12	HS14-015	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
13	HS14-016	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
14	HS14-017	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
IBM Support Document
15	1669554	http://www-01.ibm.com/support/docview.wss?uid=swg21669554
16	1675432	http://www-01.ibm.com/support/docview.wss?uid=swg21675432
17	1676091	http://www-01.ibm.com/support/docview.wss?uid=swg21676091
18	1676092	http://www-01.ibm.com/support/docview.wss?uid=swg21676092
19	1676401	http://www-01.ibm.com/support/docview.wss?uid=swg21676401
20	1676403	http://www-01.ibm.com/support/docview.wss?uid=swg21676403
21	1676405	http://www-01.ibm.com/support/docview.wss?uid=swg21676405
22	1676410	http://www-01.ibm.com/support/docview.wss?uid=swg21676410
23	1676656	http://www-01.ibm.com/support/docview.wss?uid=swg21676656
24	1676853	http://www-01.ibm.com/support/docview.wss?uid=swg21676853
25	1677691	http://www-01.ibm.com/support/docview.wss?uid=swg21677691
26	1677724	http://www-01.ibm.com/support/docview.wss?uid=swg21677724
27	1681214	http://www-01.ibm.com/support/docview.wss?uid=swg21681214
NEC製品セキュリティ情報
28	NV15-004	http://jpn.nec.com/security-info/secinfo/nv15-004.html
Oracle Critical Patch Update
29	Oracle Critical Patch Update Advisory - April 2015	http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
30	Oracle Critical Patch Update Advisory - January 2015	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
31	Oracle Critical Patch Update Advisory - January 2016	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
32	Oracle Critical Patch Update Advisory - July 2014	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
33	Oracle Critical Patch Update Advisory - October 2014	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
34	Oracle Critical Patch Update Advisory - October 2015	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
35	Oracle Critical Patch Update Advisory - October 2016	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
36	Text Form of Oracle Critical Patch Update - April 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuapr2015verbose-2365613.html
37	Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976.html
38	Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2016verbose-2367956.html
39	Text Form of Oracle Critical Patch Update - July 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2014verbose-1972958.html
40	Text Form of Oracle Critical Patch Update - October 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2014verbose-1972962.html
41	Text Form of Oracle Critical Patch Update - October 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2015verbose-2367954.html
42	Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices	http://www.oracle.com/technetwork/security-advisory/cpuoct2016verbose-2881725.html
Red Hat Bugzilla
43	Bug 1062337	https://bugzilla.redhat.com/show_bug.cgi?id=1062337
Red Hat Security Advisory
44	RHSA-2014:0400	http://rhn.redhat.com/errata/RHSA-2014-0400.html
Security Advisory
45	Huawei-SA-20140707-01-Struts2	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
SECURITY BLOG
46	April 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/april_2015_critical_patch_update
47	January 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2015_critical_patch_update
48	January 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2016_critical_patch_update
49	October 2014 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2014_critical_patch_update
50	October 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2015_critical_patch_update
51	October 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2016_critical_patch_update
VMware Security Advisories
52	VMSA-2014-0007	http://www.vmware.com/security/advisories/VMSA-2014-0007.html
ソフトウェア製品セキュリティ情報
53	HS14-008	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-008/index.html
54	HS14-015	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-015/index.html
55	HS14-016	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-016/index.html
56	HS14-017	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-017/index.html
富士通セキュリティ情報
57	Interstage Application Server: Java EE 6におけるサービス運用妨害(DoS)の脆弱性(CVE-2014-0050)	http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_as_201401.html

その他

No	Name	URL
JPCERT 緊急報告
1	Apache Commons FileUpload および Apache Tomcat の脆弱性に関する注意喚起	https://www.jpcert.or.jp/at/2014/at140007.html
JVN
2	JVN#14876762	http://jvn.jp/jp/JVN14876762/index.html
関連文書
3	MGASA-2014-0110	http://advisories.mageia.org/MGASA-2014-0110.html

Change Log

No	Changed Details	Date of change
0	[2014年02月10日] 掲載 [2014年02月13日] 概要：内容を更新対策：内容を更新ベンダ情報：Apache Software Foundation (Apache Tomcat 8.0.3) を追加 [2014年02月21日] 対策：内容を更新ベンダ情報：Apache Software Foundation (Apache Tomcat 7.0.52) を追加 [2014年02月24日] ベンダ情報：Apache Software Foundation (21 February 2014 - Immediately upgrade commons-fileupload to version 1.3.1) を追加 [2014年03月10日] 対策：内容を更新ベンダ情報：Apache Software Foundation (Struts 2.3.16.1) を追加 [2014年03月28日] ベンダ情報：富士通 (Interstage Application Server: Java EE 6におけるサービス運用妨害(DoS)の脆弱性(CVE-2014-0050)) を追加 [2014年03月31日] ベンダ情報：日立 (HS14-008) を追加 [2014年04月02日] 参考情報：National Vulnerability Database (NVD) (CVE-2014-0050) を追加 [2014年05月13日] ベンダ情報：レッドハット (RHSA-2014:0400) を追加 [2014年07月01日] ベンダ情報：VMware (VMSA-2014-0007) を追加ベンダ情報：日立 (HS14-015) を追加ベンダ情報：日立 (HS14-016) を追加ベンダ情報：日立 (HS14-017) を追加 [2014年07月25日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：Huawei (Huawei-SA-20140707-01-Struts2) を追加ベンダ情報：IBM (1677724) を追加ベンダ情報：IBM (1676853) を追加ベンダ情報：IBM (1676656) を追加ベンダ情報：IBM (1676410) を追加ベンダ情報：IBM (1676405) を追加ベンダ情報：IBM (1676403) を追加ベンダ情報：IBM (1676401) を追加ベンダ情報：IBM (1675432) を追加ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2014) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2014 Risk Matrices) を追加ベンダ情報：レッドハット (Bug 1062337) を追加 [2014年09月09日] ベンダ情報：IBM (1677691) を追加ベンダ情報：IBM (1681214) を追加 [2014年10月21日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2014) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2014 Risk Matrices) を追加ベンダ情報：オラクル (October 2014 Critical Patch Update Released) を追加 [2015年01月30日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices) を追加ベンダ情報：オラクル (January 2015 Critical Patch Update Released) を追加 [2015年04月20日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - April 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - April 2015 Risk Matrices) を追加ベンダ情報：オラクル (April 2015 Critical Patch Update Released) を追加 [2015年05月11日] 参考情報：関連文書 (MGASA-2014-0110) を追加 [2015年06月08日] ベンダ情報：日本電気 (NV15-004) を追加 [2015年06月26日] ベンダ情報：IBM (1676091) を追加ベンダ情報：IBM (1676092) を追加ベンダ情報：IBM (1669554) を追加 [2015年10月22日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2015 Risk Matrices) を追加ベンダ情報：オラクル (October 2015 Critical Patch Update Released) を追加 [2016年01月28日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices) を追加ベンダ情報：オラクル (January 2016 Critical Patch Update Released) を追加 [2016年11月22日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices) を追加ベンダ情報：オラクル (October 2016 Critical Patch Update Released) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:retail_applications:12.0in:::::::*
cpe:2.3:a:oracle:retail_applications:13.0:::::::*
cpe:2.3:a:oracle:retail_applications:13.3:::::::*
cpe:2.3:a:oracle:retail_applications:13.2:::::::*
cpe:2.3:a:oracle:retail_applications:12.0:::::::*
cpe:2.3:a:oracle:retail_applications:14.0:::::::*
cpe:2.3:a:oracle:retail_applications:13.1:::::::*
cpe:2.3:a:oracle:retail_applications:13.4:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:7.0.49:::::::*
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:7.0.34:::::::*
cpe:2.3:a:apache:tomcat:7.0.8:::::::*
cpe:2.3:a:apache:tomcat:7.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.39:::::::*
cpe:2.3:a:apache:tomcat:7.0.26:::::::*
cpe:2.3:a:apache:tomcat:7.0.46:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:8.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.50:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:commons_fileupload:1.1:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc2::::::
cpe:2.3:a:apache:tomcat:7.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.48:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc1::::::
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:7.0.44:::::::*
cpe:2.3:a:apache:tomcat:7.0.7:::::::*
cpe:2.3:a:apache:tomcat:7.0.42:::::::*
cpe:2.3:a:apache:tomcat:7.0.37:::::::*
cpe:2.3:a:apache:tomcat:7.0.29:::::::*
cpe:2.3:a:apache:tomcat:7.0.45:::::::*
cpe:2.3:a:apache:commons_fileupload::::::::		1.3
cpe:2.3:a:apache:tomcat:8.0.0:rc10::::::
cpe:2.3:a:apache:tomcat:7.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.47:::::::*
cpe:2.3:a:apache:tomcat:7.0.41:::::::*
cpe:2.3:a:apache:tomcat:7.0.31:::::::*
cpe:2.3:a:apache:tomcat:7.0.30:::::::*
cpe:2.3:a:apache:tomcat:7.0.15:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:commons_fileupload:1.1.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.36:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.35:::::::*
cpe:2.3:a:apache:tomcat:7.0.43:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc5::::::
cpe:2.3:a:apache:tomcat:7.0.32:::::::*
cpe:2.3:a:apache:tomcat:7.0.38:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.27:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.24:::::::*
cpe:2.3:a:apache:tomcat:7.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.40:::::::*
cpe:2.3:a:apache:tomcat:7.0.9:::::::*
cpe:2.3:a:apache:commons_fileupload:1.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.3:::::::*
cpe:2.3:a:apache:tomcat:7.0.33:::::::*