In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jakarta-commons-httpclientUpgrade apache-commons-netUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade xsomUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade javassistUpgrade javassist-javadocUpgrade xalan-j2Upgrade slf4jUpgrade pki-servlet-4.0-apiUpgrade pki-servlet-engineUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade xerces-j2Upgrade jackson-databindUpgrade resteasyUpgrade jackson-jaxrs-json-providerUpgrade python3-nssUpgrade jackson-coreUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collections | May 4, 2022 | Feb 24, 2020 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-3.1-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsvc | Aug 24, 2023 | Feb 24, 2020 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Mar 14, 2020 | Feb 24, 2020 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.31Upgrade Apache Tomcat to 8.5.51Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.100 | Feb 24, 2020 | Feb 24, 2020 |
| Centos_linux | — | Upgrade pki-caUpgrade slf4j-jdk14Upgrade tomcat-el-2.2-apiUpgrade python3-nssUpgrade jackson-annotationsUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade tomcat-libUpgrade jackson-databindUpgrade velocityUpgrade xerces-j2Upgrade xmlstreambufferUpgrade xml-commons-apisUpgrade stax-exUpgrade slf4jUpgrade python-nss-docUpgrade jssUpgrade jackson-jaxrs-json-providerUpgrade pki-kraUpgrade tomcat-admin-webappsUpgrade tomcat-jsvcUpgrade tomcat-servlet-3.0-apiUpgrade apache-commons-collectionsUpgrade pki-core-debugsourceUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade jss-javadocUpgrade jackson-module-jaxb-annotationsUpgrade xsomUpgrade xml-commons-resolverUpgrade tomcatjssUpgrade tomcat-javadocUpgrade pki-tools-debuginfoUpgrade apache-commons-netUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade pki-core-debuginfoUpgrade resteasyUpgrade jss-debuginfoUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade ldapjdkUpgrade jss-debugsourceUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade pki-baseUpgrade relaxngDatatypeUpgrade python-nss-debugsourceUpgrade pki-servlet-4.0-apiUpgrade python3-nss-debuginfoUpgrade tomcat-docs-webappUpgrade tomcatUpgrade python3-pkiUpgrade pki-symkeyUpgrade apache-commons-langUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade pki-serverUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-core | Nov 11, 2020 | Feb 24, 2020 |
| Debian | — | Upgrade tomcat9 | Mar 6, 2020 | Feb 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-api | Mar 24, 2020 | Feb 24, 2020 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3 | Jan 19, 2021 | Feb 24, 2020 |
| Oracle_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-libUpgrade tomcat-el-2.2-api | Nov 12, 2020 | Feb 24, 2020 |
| Redhat_linux | — | Upgrade javassist-javadocUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade xsomUpgrade tomcatjssUpgrade xalan-j2Upgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade apache-commons-langUpgrade slf4jUpgrade tomcat-jsp-2.2-apiUpgrade pki-servlet-engineUpgrade jackson-annotationsUpgrade python3-pkiUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade apache-commons-netUpgrade tomcat-javadocUpgrade resteasyUpgrade xml-commons-resolverUpgrade jakarta-commons-httpclientUpgrade pki-caUpgrade jss-javadocUpgrade tomcatUpgrade pki-base-javaUpgrade tomcat-jsvcUpgrade jss-debugsourceUpgrade pki-core-debuginfoUpgrade glassfish-fastinfosetUpgrade pki-toolsUpgrade python3-nss-debuginfoUpgrade pki-serverUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdk-javadocUpgrade pki-servlet-4.0-apiUpgrade python-nss-docUpgrade ldapjdkUpgrade pki-symkeyUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade jackson-databindUpgrade tomcat-libUpgrade pki-kraUpgrade jackson-coreUpgrade jssUpgrade pki-tools-debuginfoUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade xml-commons-apisNo solution existsUpgrade pki-symkey-debuginfoUpgrade xerces-j2Upgrade bea-stax-apiUpgrade jackson-jaxrs-providersUpgrade jss-debuginfoUpgrade python3-nssUpgrade tomcat-el-2.2-api | Nov 11, 2020 | Feb 24, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss | Mar 12, 2024 | Feb 24, 2020 |
| Suse | — | Upgrade tomcat-embedUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-3_0-apiUpgrade tomcat | Mar 6, 2020 | Feb 24, 2020 |
| Ubuntu | — | Upgrade libtomcat8-javaUpgrade tomcat8 | Aug 5, 2020 | Feb 24, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub