Description
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected products
- apache / Apache TomcatApache Tomcat 9.0.0.M1 to 9.0.30 – Apache Tomcat 9.0.0.M1 to 9.0.30
- apache / Apache Tomcat7.0.0 to 7.0.99 – 7.0.0 to 7.0.99
- apache / Apache Tomcat8.5.0 to 8.5.50 – 8.5.0 to 8.5.50
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat7.0.0 – 7.0.99
- apache / Tomcat9.0.0 – 9.0.0
- Canonical / Ubuntu Linux16.04 – 16.04
- Debian / debian_linux9.0 – 9.0
- Debian / debian_linux10.0 – 10.0
- Debian / debian_linux8.0 – 8.0
- NetApp / data_availability_services
- NetApp / oncommand_system_manager3.0.0 – 3.1.3
- openSUSE / Leap15.1 – 15.1
- oracle / agile_engineering_data_management6.2.1.0 – 6.2.1.0
- oracle / agile_product_lifecycle_management9.3.3 – 9.3.3
- oracle / agile_product_lifecycle_management9.3.5 – 9.3.5
- oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
- oracle / communications_element_manager8.1.1 – 8.1.1
- oracle / communications_element_manager8.2.0 – 8.2.0
- oracle / communications_element_manager8.2.1 – 8.2.1
- oracle / communications_instant_messaging_server10.0.1.4.0 – 10.0.1.4.0
- oracle / health_sciences_empirica_inspections1.0.1.2 – 1.0.1.2
- oracle / health_sciences_empirica_signal7.3.3 – 7.3.3
- oracle / hospitality_guest_access4.2.0 – 4.2.0
- oracle / hospitality_guest_access4.2.1 – 4.2.1
- oracle / hyperion_infrastructure_technology11.1.2.4 – 11.1.2.4
- oracle / instantis_enterprisetrack17.1 – 17.3
- oracle / MySQL Enterprise Monitor4.0.0 – 4.0.12
- oracle / retail_order_broker15.0 – 15.0
- oracle / Siebel UI Framework20.5
- oracle / transportation_management6.3.7 – 6.3.7
- oracle / workload_manager12.2.0.1 – 12.2.0.1
- oracle / workload_manager18c – 18c
- oracle / workload_manager19c – 19c
References
- MAILING_LISThttps://lists.apache.org/thread.html/r127f76181aceffea2bd4711b03c595d0f115f63e020348fe925a916c%40%3Cannounce.tomcat.apache.org%3E
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/03/msg00006.html
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html
- MAILING_LISThttps://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743%40%3Ccommits.tomee.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.tomee.apache.org%3E
- VENDOR_ADVISORYhttps://www.debian.org/security/2020/dsa-4673
- VENDOR_ADVISORYhttps://www.debian.org/security/2020/dsa-4680
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/05/msg00026.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2020.html
- MISChttps://security.netapp.com/advisory/ntap-20200327-0005/
- MAILING_LISThttps://lists.apache.org/thread.html/r441c1f30a252bf14b07396286f6abd8089ce4240e91323211f1a2d75%40%3Cusers.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r660cd379afe346f10d72c0eaa8459ccc95d83aff181671b7e9076919%40%3Cusers.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/rd547be0c9d821b4b1000a694b8e58ef9f5e2d66db03a31dfe77c4b18%40%3Cusers.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/ra5dee390ad2d60307b8362505c059cd6a726de4d146d63dfce1e05e7%40%3Cusers.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r80e9c8417c77d52c62809168b96912bda70ddf7748f19f8210f745b1%40%3Cusers.tomcat.apache.org%3E
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4448-1/
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2021.html
- MAILING_LISThttps://lists.apache.org/thread.html/r9ce7918faf347e7aac32be930bf26c233b0b140fe37af0bb294158b6%40%3Cdev.tomcat.apache.org%3E
Updated 18m ago · 8 sources