HTTP Request Smuggling Affecting tomcat-el-3_0-api package, versions <9.0.31-3.42.2
Snyk CVSS
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES150-TOMCATEL30API-2714495
- published 14 Apr 2022
- disclosed 5 Mar 2020
Introduced: 5 Mar 2020
CVE-2019-17569 Open this link in a new tabHow to fix?
Upgrade SLES:15.0
tomcat-el-3_0-api
to version 9.0.31-3.42.2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream tomcat-el-3_0-api
package and not the tomcat-el-3_0-api
package as distributed by SLES:15.0
.
See How to fix?
for SLES:15.0
relevant fixed versions and status.
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
References
- CVE-2019-17569
- E-Mail link for SUSE-SU-2020:0598-1
- Link for SUSE-SU-2020:0598-1
- SUSE Bug 1164692
- SUSE Bug 1164825
- SUSE Bug 1164860
- SUSE CVE CVE-2019-17569 page
- SUSE CVE CVE-2020-1935 page
- SUSE CVE CVE-2020-1938 page
- SUSE Security Ratings
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org