Description
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected products
- apache / Tomcat8.5.0 – 8.5.66
- apache / tomee8.0.6 – 8.0.6
- Apache Software Foundation / Apache TomcatApache Tomcat 9 9.0.0.M1 to 9.0.46 – Apache Tomcat 9 9.0.0.M1 to 9.0.46
- Apache Software Foundation / Apache TomcatApache Tomcat 8 8.5.0 to 8.5.66 – Apache Tomcat 8 8.5.0 to 8.5.66
- Apache Software Foundation / Apache TomcatApache Tomcat 10 10.0.0-M1 to 10.0.6 – Apache Tomcat 10 10.0.0-M1 to 10.0.6
- debian / debian_linux9.0 – 9.0
- debian / debian_linux10.0 – 10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- McAfee / epolicy_orchestrator5.10.0 – 5.10.0
- oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
- oracle / communications_cloud_native_core_policy1.14.0 – 1.14.0
- oracle / communications_cloud_native_core_service_communication_proxy1.14.0 – 1.14.0
- oracle / communications_diameter_signaling_router8.0.0.0 – 8.5.0.2
- oracle / communications_instant_messaging_server10.0.1.5.0 – 10.0.1.5.0
- oracle / communications_policy_management12.5.0 – 12.5.0
- oracle / communications_pricing_design_center12.0.0.3.0 – 12.0.0.3.0
- oracle / communications_session_report_manager8.0.0 – 8.2.4.0
- oracle / communications_session_route_manager8.0.0 – 8.2.4
- oracle / graph_server_and_client21.4
- oracle / healthcare_translational_research4.1.0 – 4.1.0
- oracle / hospitality_cruise_shipboard_property_management_system20.1.0 – 20.1.0
- oracle / instantis_enterprisetrack17.1 – 17.1
- oracle / instantis_enterprisetrack17.2 – 17.2
- oracle / instantis_enterprisetrack17.3 – 17.3
- oracle / managed_file_transfer12.2.1.4.0 – 12.2.1.4.0
- oracle / managed_file_transfer12.2.1.3.0 – 12.2.1.3.0
- oracle / MySQL Enterprise Monitor8.0.25
- oracle / sd-wan_edge9.0 – 9.0
- oracle / sd-wan_edge9.1 – 9.1
- oracle / secure_global_desktop5.6 – 5.6
- oracle / utilities_testing_accelerator6.0.0.3.1 – 6.0.0.3.1
- oracle / utilities_testing_accelerator6.0.0.1.1 – 6.0.0.1.1
- oracle / utilities_testing_accelerator6.0.0.2.2 – 6.0.0.2.2
References
- MAILING_LISThttps://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E
- VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
- MAILING_LISThttps://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2021/08/msg00009.html
- VENDOR_ADVISORYhttps://www.debian.org/security/2021/dsa-4952
- MAILING_LISThttps://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
- MISChttps://security.netapp.com/advisory/ntap-20210827-0007/
- MISChttps://kc.mcafee.com/corporate/index?page=content&id=SB10366
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
- MISChttps://security.gentoo.org/glsa/202208-34
Updated 19m ago · 8 sources