CVE-2019-17569
MEDIUM4.8EPSS 6.2%Potential HTTP request smuggling in Apache Tomcat
發布日:2020/2/28修改日:2024/2/21
描述
The refactoring present in Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
受影響套件(5)
- Debian/tomcat7from 0, < 7.0.56-3+really7.0.100-1
- Debian/tomcat8from 0, < 8.5.54-0+deb9u1
- Debian/tomcat9from 0, < 9.0.31-1
- Maven/org.apache.tomcat.embed:tomcat-embed-core>= 7.0.98, < 7.0.100
- Maven/org.apache.tomcat:tomcat>= 7.0.98, < 7.0.100
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
參考連結(13)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-17569
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-17569
- WEBhttp://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html
- WEBhttps://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78@%3Ccommits.tomee.apache.org%3E
- WEBhttps://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E
- WEBhttps://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743@%3Ccommits.tomee.apache.org%3E
- WEBhttps://lists.debian.org/debian-lts-announce/2020/03/msg00006.html
- WEBhttps://security.netapp.com/advisory/ntap-20200327-0005
- WEBhttps://www.debian.org/security/2020/dsa-4673
- WEBhttps://www.debian.org/security/2020/dsa-4680
- WEBhttps://www.oracle.com/security-alerts/cpujan2021.html
- WEBhttps://www.oracle.com/security-alerts/cpujul2020.html
- WEBhttps://www.oracle.com/security-alerts/cpuoct2020.html