请教师父，Apache Tomcat:7.0.40 怎么打cve-2014-0050补丁

[cainiaolwj]

请问在Linux下怎么给Apache Tomcat:7.0.40 打cve-2014-0050补丁

[save4me]

可以升级TomCat 7.0.52及以上版本。如果不想升级，可以参考Schlaf, Tomcat, Schlaf - Tomcat/Apache Commons FileUpload DoS und Workarounds CVE-2014-0050

# untested, headers-module needed
#RequestHeader unset Content-Type "multipart\/form-data;(\s*)boundary=[a-zA-Z0-9_-]{4000}"

RewriteEngine On
RewriteCond %{HTTP:Content-Type} "multipart\/form-data;(\s*)boundary=[a-zA-Z0-9_-]{4000}"
RewriteRule ^/(.*)$ /405.html [R=301,L]

------------------

# serverfault
SetEnvIf Content-Type ^.{4000,}$ bad-content-type=1
RequestHeader unset Content-Type env=bad-content-type