Skip to content
OpenAdvisories
Low ELSA-2020-5020 1 CVE

Low: tomcat security update (Oracle Linux 7)

Published Nov 12, 2020 · Updated Nov 12, 2020

Ecosystem: Oracle Linux

Summary

[0:7.0.76-16]
- Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-javadoc 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-jsvc 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-lib 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.76-16.el7_9
Oracle Linux · 7 tomcat-webapps 0:7.0.76-16.el7_9

Vulnerabilities 1

  • Medium 4.8
    CVE-2020-1935

    Potential HTTP request smuggling in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven