文件上传组件导致Apache DoS安全漏洞

近日，Apache Tomcat官网通报了Apache Commons Fileupload 文件上传组件问题，导致Apache Tomcat 7&8版本Dos存在安全漏洞，其中受影响的版本包括：

Versions Affected:

- - Commons FileUpload 1.0 to 1.3

- - Apache Tomcat 8.0.0-RC1 to 8.0.1

- - Apache Tomcat 7.0.0 to 7.0.50

- - Apache Tomcat 6 and earlier are not affected

由于在Tomcat 7和Tomcat 8里重新命名Apache Commons FileUpload复本，该复本被打包在一个包里，用来实现Servlet 3.0及以后版本的要求规范来支持mime-multipart请求。

此次安全漏洞等级为重要。

修复方法：

Mitigation:

Users of affected versions should apply one of the following mitigations

- - Upgrade to Apache Commons FileUpload 1.3.1 or later once released

- - Upgrade to Apache Tomcat 8.0.2 or later once released

- - Upgrade to Apache Tomcat 7.0.51 or later once released

- - Apply the appropriate patch

- Commons FileUpload:http://svn.apache.org/r1565143

- Tomcat 8:http://svn.apache.org/r1565163

- Tomcat 7:http://svn.apache.org/r1565169

- - Limit the size of the Content-Type header to less than 4091 bytes