Skip to content
OpenAdvisories
Medium · 4.8 CVE-2019-17569 EUVD-2020-0293GHSA-767j-jfh2-jvrc

Potential HTTP request smuggling in Apache Tomcat

Published Feb 24, 2020 · Updated Aug 5, 2024 · Assigned by apache

Vendor: Apache Product: Apache Tomcat Package: org.apache.tomcat:tomcat Package: org.apache.tomcat.embed:tomcat-embed-core Package: tomcat9 Ecosystem: Debian Ecosystem: Maven

Description

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Affected products

VendorProductAffectedFixed
Apache Apache Tomcat Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50, 7.0.98 to 7.0.99 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat9 9.0.31-1 —
Debian 13 tomcat9 9.0.31-1 —
Debian 12 tomcat9 9.0.31-1 —
Debian 10 tomcat9 9.0.31-1~deb10u1 DSA-4680-1
Debian 9 tomcat8 8.5.54-0+deb9u1 DSA-4673-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 8 tomcat7 7.0.56-3+really7.0.100-1 DLA-2133-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss Web Server 5 jws5-tomcat +9 9.0.30-3.redhat_4.1.el6jws RHSA-2020:1520
Red Hat JBoss Web Server 5 jws5-tomcat-native 1.2.23-4.redhat_4.el6jws RHSA-2020:1520

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP1 tomcat 9.0.31-4.22.1 SUSE-SU-2020:0631-1
SLES 15 tomcat 9.0.31-3.42.2 SUSE-SU-2020:0598-1
SLES 12 SP5 tomcat 9.0.31-3.25.1 SUSE-SU-2020:0632-1
SLES 12 SP4 tomcat 9.0.31-3.25.1 SUSE-SU-2020:0632-1
SLES 12 SP3 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1
Show 14 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP2 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1
SLES 12 SP1 tomcat 8.0.53-10.43.1 SUSE-SU-2020:1497-1
SLES for SAP 15 tomcat 9.0.31-3.42.2 SUSE-SU-2020:0598-1
SLES for SAP 12 SP5 tomcat 9.0.31-3.25.1 SUSE-SU-2020:0632-1
SLES for SAP 12 SP4 tomcat 9.0.31-3.25.1 SUSE-SU-2020:0632-1
SLES for SAP 12 SP3 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1
SLES for SAP 12 SP2 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1
SLES for SAP 12 SP1 tomcat 8.0.53-10.43.1 SUSE-SU-2020:1497-1
SLE HPC 15 tomcat 9.0.31-3.42.2 SUSE-SU-2020:0598-1
SUSE OpenStack Cloud Crowbar 8 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1
SUSE OpenStack Cloud 8 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1
SUSE OpenStack Cloud 7 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1
SUSE HPE Helion OpenStack 8 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1
SUSE Enterprise Storage 5 tomcat 8.0.53-29.27.1 SUSE-SU-2020:1498-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.36-8.4 openSUSE-SU-2024:11468-1
openSUSE Tumbleweed tomcat10 10.1.14-1.1 openSUSE-SU-2024:13441-1
openSUSE Leap 15.1 tomcat 9.0.31-lp151.3.12.1 openSUSE-SU-2020:0345-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat >= 7.0.98, < 7.0.100 7.0.100 GHSA-767j-jfh2-jvrc
Maven org.apache.tomcat:tomcat >= 8.5.48, < 8.5.51 8.5.51 GHSA-767j-jfh2-jvrc
Maven org.apache.tomcat:tomcat >= 9.0.28, < 9.0.31 9.0.31 GHSA-767j-jfh2-jvrc
Maven org.apache.tomcat.embed:tomcat-embed-core >= 7.0.98, < 7.0.100 7.0.100 GHSA-767j-jfh2-jvrc
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.48, < 8.5.51 8.5.51 GHSA-767j-jfh2-jvrc
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.28, < 9.0.31 9.0.31 GHSA-767j-jfh2-jvrc

Advisories 13

References