NetSight
IP …
medium4.8

CVE-2019-17569

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression.

Impact

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Affected products

VendorProductAffected versions
ApacheTomcat
from 7.0.98 through 7.0.99
from 8.5.48 through 8.5.50
from 9.0.28 through 9.0.30
ApacheTomee
Version 7.0.7
OpensuseLeap
Version 15.1
NetappData Availability Services
All versions
NetappOncommand System Manager
from 3.0.0 through 3.1.3
DebianDebian Linux
Versions 9.0, 10.0
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.5, 9.3.6
OracleCommunications Instant Messaging Server
Version 10.0.1.4.0
OracleHealth Sciences Empirica Inspections
Version 1.0.1.2
OracleHealth Sciences Empirica Signal
Version 7.3.3
OracleHospitality Guest Access
Versions 4.2.0, 4.2.1

Weakness classification

CWE-444

References