CVE-2019-17569
Medium
Description
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
SeverityMedium
CVSS4.8
Exploit probability—
Product
Apache Tomcat
PublishedFeb 24, 2020
First seenFeb 24, 2020
How to fix
Update
- org.apache.tomcat.embed:tomcat-embed-core7.0.100, 8.5.51, 9.0.31 or later
- org.apache.tomcat:tomcat7.0.100, 8.5.51, 9.0.31 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 7.0.98 ≤ v ≤ 7.0.99, 8.5.48 ≤ v ≤ 8.5.50, 9.0.28 ≤ v ≤ 9.0.30 | — |
| apache tomee | 7.0.7 | — |
| opensuse leap | 15.1 | — |
| netapp data_availability_services | No range specified | — |
| netapp oncommand_system_manager | 3.0.0 ≤ v ≤ 3.1.3 | — |
| debian debian_linux | 9.0, 10.0 | — |
| oracle agile_engineering_data_management | 6.2.1.0 | — |
| oracle agile_product_lifecycle_management | 9.3.3, 9.3.5, 9.3.6 | — |
| oracle communications_instant_messaging_server | 10.0.1.4.0 | — |
| oracle health_sciences_empirica_inspections | 1.0.1.2 | — |
| oracle health_sciences_empirica_signal | 7.3.3 | — |
| oracle hospitality_guest_access | 4.2.0, 4.2.1 | — |
| oracle instantis_enterprisetrack | 17.1 ≤ v ≤ 17.3 | — |
| oracle mysql_enterprise_monitor | v ≤ 4.0.12, 8.0.0 ≤ v ≤ 8.0.20 | — |
| oracle transportation_management | 6.3.7 | — |
| oracle workload_manager | 12.2.0.1, 18c, 19c | — |
| org.apache.tomcat.embed:tomcat-embed-coreMaven | 7.0.98 ≤ v < 7.0.100, 8.5.48 ≤ v < 8.5.51, 9.0.28 ≤ v < 9.0.31 | 7.0.100, 8.5.51, 9.0.31 |
| org.apache.tomcat:tomcatMaven | 7.0.98 ≤ v < 7.0.100, 8.5.48 ≤ v < 8.5.51, 9.0.28 ≤ v < 9.0.31 | 7.0.100, 8.5.51, 9.0.31 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.