Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46589: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | tomcat9 | 1:9.0.82-1.amzn2023.0.2 |
| Amazon Linux · 2023 | tomcat9-admin-webapps | 1:9.0.82-1.amzn2023.0.2 |
| Amazon Linux · 2023 | tomcat9-docs-webapp | 1:9.0.82-1.amzn2023.0.2 |
| Amazon Linux · 2023 | tomcat9-el-3.0-api | 1:9.0.82-1.amzn2023.0.2 |
| Amazon Linux · 2023 | tomcat9-jsp-2.3-api | 1:9.0.82-1.amzn2023.0.2 |
| Amazon Linux · 2023 | tomcat9-lib | 1:9.0.82-1.amzn2023.0.2 |
| Amazon Linux · 2023 | tomcat9-servlet-4.0-api | 1:9.0.82-1.amzn2023.0.2 |
| Amazon Linux · 2023 | tomcat9-webapps | 1:9.0.82-1.amzn2023.0.2 |
Vulnerabilities 1
-
High 7.5
Apache Tomcat: HTTP request smuggling via malformed trailer headers
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-46589.html