https://bugzilla.redhat.com/show_bug.cgi?id=1069921
--- Doc Text *updated* ---
==tomcat
Tomcat was found to accept content-length headers with chunked encoding over any HTTP
connector and multiple content-length headers in a request when using the AJP connector.
This could allow attackers to poison a web-cache, bypass web application firewall
protection, or conduct cross-site scripting attacks.
==jbossweb
It was found that when JBoss Web processed a series of HTTP requests in
which at least one request contained either multiple content-length
headers, or one content-length header with a chunked transfer-encoding
header, JBoss Web would incorrectly handle the request. A remote attacker
could use this flaw to poison a web cache, perform cross-site scripting
(XSS) attacks, or obtain sensitive information from other requests.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=jJI07ChxsX&a=cc_unsubscribe