CVE-2019-17569

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-17569
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-17569.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-17569
Aliases
Related
Published
2020-02-24T22:15:11Z
Modified
2024-10-12T04:35:20.911685Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

References

Affected packages

Debian:11 / tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.31-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.31-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.31-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
7c14efedba0cc81319efacb0e7f5129804e7b6f9
Last affected
4fab4cc012d0c31852e957d198cb0549f3d6074c
Last affected
6ebe68b8319cbd8c4fa9b629f38b10c09ca38b61
Introduced
fde40d7e0c7a1b0b2423cb84ad220a5d98b65591
Last affected
a94a0258f36d064aa032608a9e99c62018f22d94
Introduced
35174cb9cfa4cf3d608db77485043af42cf92c8c
Last affected
c40ede65ea4fb44b1957ec482f28c7afa71f1b50
Type
GIT
Repo
https://github.com/apache/tomee
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
24420829cd7de768df247fa7b3c8ae62c13a68e2

Affected versions

tomee-7.*

tomee-7.0.5
tomee-7.0.6
tomee-7.0.7