HTTP Request Smuggling Affecting jws5-tomcat package, versions <0:9.0.30-3.redhat_4.1.el8jws


Severity

Recommended
high

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.35% (72nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-JWS5TOMCAT-4403410
  • published1 Nov 2021
  • disclosed24 Feb 2020

Introduced: 24 Feb 2020

CVE-2019-17569  (opens in a new tab)
CWE-444  (opens in a new tab)

How to fix?

Upgrade RHEL:8 jws5-tomcat to version 0:9.0.30-3.redhat_4.1.el8jws or higher.
This issue was patched in RHSA-2020:1520.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jws5-tomcat package and not the jws5-tomcat package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

CVSS Scores

version 3.1