Tomcat all system reports Request Vulnerability CVE-2014-0227

Tomcat all system reports Request Vulnerability CVE-2014-0227

CVE-2014-0227 Request Smuggling

Hazard level: Important!

Affected Versions include:
--Apache Tomcat 8.0.0-RC1 to 8.0.8
--Apache Tomcat 7.0.0 to 7.0.54
--Apache Tomcat 6.0.0 to 6.0.41

Vulnerability description:

The chucked request contains a damaged chunk, which may cause Tomcat to read the body of some requests as a new request.

Solution:
--Upgrade to Apache Tomcat 8.0.9 or later
--Upgrade to Apache Tomcat 7.0.55 or later
--Upgrade to Apache Tomcat 6.0.43 or later (6.0.42 contains the fix but was not released)

Official Message:
Http://mail-archives.apache.org/mod_mbox/www-announce/201502.mbox/%3C54D87A0F.7010400@apache.org%3E

Load Balancing between Apache and multiple Tomcat clusters in Linux

Nginx Tomcat Cluster load balancing solution notes

Instance details Tomcat component installation + Nginx reverse proxy Tomcat + Apache use mod_jk and mod_proxy Reverse Proxy and load balancing

Deploy a log server using Rsyslog + LogAnalyzer + MySQL in CentOS 6.5

Build an Apache + Tomcat environment (JK deployment process)

Tomcat details: click here
Tomcat: click here

This article permanently updates the link address: