Re: POST form parameter parsing order

2011-12-30 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Konstantin, On 12/30/11 3:53 PM, Konstantin Kolinko wrote: > 2011/12/30 Christopher Schultz : >> >> On 12/30/11 4:35 AM, Gadi Katsovich wrote: >>> I am using Tomcat 5.5.30 and am affected by the hashtable >>> collision DoS vulnerability. >> >> Just

Re: POST form parameter parsing order

2011-12-30 Thread Konstantin Kolinko
2011/12/30 Christopher Schultz : > > On 12/30/11 4:35 AM, Gadi Katsovich wrote: >> I am using Tomcat 5.5.30 and am affected by the hashtable collision >> DoS vulnerability. > > Just wondering: are you actually under attack, or are you just saying > that you are vulnerable? > > I would venture a gue

Re: POST form parameter parsing order

2011-12-30 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Gadi, On 12/30/11 4:35 AM, Gadi Katsovich wrote: > I am using Tomcat 5.5.30 and am affected by the hashtable collision > DoS vulnerability. Just wondering: are you actually under attack, or are you just saying that you are vulnerable? I would ventur

Re: POST form parameter parsing order

2011-12-30 Thread markt
Gadi Katsovich wrote: >Hello All, >I am using Tomcat 5.5.30 and am affected by the hashtable collision DoS >vulnerability. >I wanted to know if the Request parameter parsing is always invoked? > >Or is it only performed once a servlet asks for a parameter? Meaning if >my servlets don't ask for a

POST form parameter parsing order

2011-12-30 Thread Gadi Katsovich
Hello All, I am using Tomcat 5.5.30 and am affected by the hashtable collision DoS vulnerability. I wanted to know if the Request parameter parsing is always invoked? Or is it only performed once a servlet asks for a parameter? Meaning if my servlets don't ask for a parameter, then no hashing,