Skip to content
OpenAdvisories
Medium ALAS2-2023-2216 1 CVE

Moderate: tomcat security update (Amazon Linux 2)

Published Aug 17, 2023 · Updated Aug 23, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1935: A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line (EOL) parsing that allowed some invalid HTTP headers to be parsed as valid. This led to the possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. The highest threat with this vulnerability is system availability.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 tomcat 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-admin-webapps 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-docs-webapp 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-el-2.2-api 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-javadoc 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-jsp-2.2-api 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-jsvc 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-lib 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-servlet-3.0-api 0:7.0.76-10.amzn2.0.6
Amazon Linux · 2 tomcat-webapps 0:7.0.76-10.amzn2.0.6

Vulnerabilities 1

  • Medium 4.8
    CVE-2020-1935

    Potential HTTP request smuggling in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-1935.html