CVEvulnerability

CVE-2019-17569

4.8 MEDIUM Published 2020-02-24 Modified 2026-08-25 Official page ↗
Status
Modified
Published
2020-02-24
Last modified
2026-08-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-444

Description

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Affected configurations

• apache tomcat (>= 7.0.98 <= 7.0.99) • apache tomcat (>= 8.5.48 <= 8.5.50) • apache tomcat (>= 9.0.28 <= 9.0.30) • apache tomee 7.0.7 • opensuse leap 15.1 • netapp data availability services • netapp oncommand system manager (>= 3.0.0 <= 3.1.3) • debian debian linux 9.0 • debian debian linux 10.0 • oracle agile engineering data management 6.2.1.0 • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle communications instant messaging server 10.0.1.4.0 • oracle health sciences empirica inspections 1.0.1.2 • oracle health sciences empirica signal 7.3.3 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle instantis enterprisetrack (>= 17.1 <= 17.3) • oracle mysql enterprise monitor (<= 4.0.12) • oracle mysql enterprise monitor (>= 8.0.0 <= 8.0.20) • oracle transportation management 6.3.7 • oracle workload manager 12.2.0.1 • oracle workload manager 18c • oracle workload manager 19c

Related

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References