Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment
Moderate severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Feb 27, 2024
Package
Affected versions
>= 7.0.0, < 7.0.7
>= 6.0.0, < 6.0.32
>= 5.5.0, < 5.5.33
Patched versions
7.0.7
6.0.32
5.5.33
Description
Published by the National Vulnerability Database
Feb 17, 2011
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Feb 27, 2024
Last updated
Feb 27, 2024
Credits
-
sunSUNQ Analyst
The
Double.parseDoublemethod in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.Apache Tomcat introduced workarounds to avoid being affected by this issue in versions 7.0.7, 6.0.32, and 5.5.33.
References