In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jakarta-commons-httpclientUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade slf4jUpgrade apache-commons-netUpgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade xsomUpgrade xalan-j2Upgrade javassist-javadocUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade bea-stax-apiUpgrade velocityUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade resteasyUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-engineUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade apache-commons-collections | May 4, 2022 | Feb 24, 2020 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-javadocUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-webapps | Aug 24, 2023 | Feb 24, 2020 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Mar 14, 2020 | Feb 24, 2020 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.31Upgrade Apache Tomcat to 8.5.51Upgrade Apache Tomcat to 7.0.100Upgrade Apache Tomcat to the latest available version | Feb 24, 2020 | Feb 24, 2020 |
| Centos_linux | — | Upgrade tomcat-admin-webappsUpgrade stax-exUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade jackson-databindUpgrade pki-kraUpgrade slf4jUpgrade tomcat-libUpgrade xerces-j2Upgrade velocityUpgrade xmlstreambufferUpgrade jssUpgrade python-nss-docUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade tomcat-el-2.2-apiUpgrade pki-caUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade python3-nssUpgrade xsomUpgrade resteasyUpgrade pki-core-debuginfoUpgrade apache-commons-netUpgrade tomcatjssUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-providersUpgrade pki-base-javaUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-txw2Upgrade pki-symkeyUpgrade pki-baseUpgrade pki-core-debugsourceUpgrade tomcat-webappsUpgrade python3-nss-debuginfoUpgrade apache-commons-collectionsUpgrade python3-pkiUpgrade apache-commons-langUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade tomcatUpgrade tomcat-docs-webappUpgrade xalan-j2Upgrade pki-serverUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade tomcat-jsp-2.2-apiUpgrade glassfish-jaxb-coreUpgrade jss-javadocUpgrade jss-debugsourceUpgrade javassistUpgrade xml-commons-resolverUpgrade tomcat-javadocUpgrade pki-tools-debuginfoUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade ldapjdkUpgrade jakarta-commons-httpclientUpgrade tomcat-jsvcUpgrade jss-debuginfoUpgrade tomcat-servlet-3.0-apiUpgrade pki-servlet-engine | Nov 11, 2020 | Feb 24, 2020 |
| Debian | — | Upgrade tomcat9 | Mar 6, 2020 | Feb 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-api | Mar 24, 2020 | Feb 24, 2020 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3 | Jan 19, 2021 | Feb 24, 2020 |
| Oracle_linux | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-javadoc | Nov 12, 2020 | Feb 24, 2020 |
| Redhat_linux | — | Upgrade xmlstreambufferUpgrade xerces-j2Upgrade tomcat-admin-webappsUpgrade pki-kraUpgrade jackson-databindUpgrade pki-symkeyUpgrade tomcat-libUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade python3-nssUpgrade glassfish-jaxb-apiUpgrade pki-tools-debuginfoUpgrade jssUpgrade stax-exUpgrade tomcat-el-2.2-apiUpgrade jackson-coreUpgrade velocityUpgrade jss-debuginfoUpgrade jackson-jaxrs-providersNo solution existsUpgrade pki-symkey-debuginfoUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade tomcat-webappsUpgrade resteasyUpgrade xsomUpgrade pki-core-debugsourceUpgrade jackson-annotationsUpgrade jakarta-commons-httpclientUpgrade jss-javadocUpgrade pki-toolsUpgrade tomcat-jsvcUpgrade tomcat-servlet-3.0-apiUpgrade relaxngDatatypeUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-txw2Upgrade jss-debugsourceUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade ldapjdk-javadocUpgrade slf4jUpgrade xalan-j2Upgrade javassist-javadocUpgrade python3-pkiUpgrade pki-baseUpgrade tomcat-javadocUpgrade apache-commons-netUpgrade python3-nss-debuginfoUpgrade apache-commons-langUpgrade pki-base-javaUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade pki-core-debuginfoUpgrade apache-commons-collectionsUpgrade tomcat-docs-webappUpgrade pki-caUpgrade tomcatjssUpgrade tomcatUpgrade pki-serverUpgrade glassfish-fastinfosetUpgrade tomcat-jsp-2.2-apiUpgrade jackson-module-jaxb-annotationsUpgrade javassist | Nov 11, 2020 | Feb 24, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-doc | Mar 12, 2024 | Feb 24, 2020 |
| Suse | — | Upgrade tomcat-servlet-3_1-apiUpgrade tomcat-javadocUpgrade tomcat-embedUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2_3-apiUpgrade tomcatUpgrade tomcat-el-3_0-apiUpgrade tomcat-webappsUpgrade tomcat-jsvc | Mar 6, 2020 | Feb 24, 2020 |
| Ubuntu | — | Upgrade tomcat8Upgrade libtomcat8-java | Aug 5, 2020 | Feb 24, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub