CVE-2021-33037

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

• apache tomcat (>= 8.5.0 <= 8.5.66) • apache tomcat (> 9.0.0 <= 9.0.46) • apache tomcat (> 10.0.0 <= 10.0.6) • apache tomee 8.0.6 • debian debian linux 9.0 • debian debian linux 10.0 • oracle agile product lifecycle management 9.3.6 • oracle communications cloud native core policy 1.14.0 • oracle communications cloud native core service communication proxy 1.14.0 • oracle communications diameter signaling router (>= 8.0.0.0 <= 8.5.0.2) • oracle communications instant messaging server 10.0.1.5.0 • oracle communications policy management 12.5.0 • oracle communications pricing design center 12.0.0.3.0 • oracle communications session report manager (>= 8.0.0 <= 8.2.4.0) • oracle communications session route manager (>= 8.0.0 <= 8.2.4) • oracle graph server and client (< 21.4) • oracle healthcare translational research 4.1.0 • oracle hospitality cruise shipboard property management system 20.1.0 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle instantis enterprisetrack 17.3 • oracle managed file transfer 12.2.1.3.0 • oracle managed file transfer 12.2.1.4.0 • oracle mysql enterprise monitor (<= 8.0.25) • oracle sd-wan edge 9.0 • oracle sd-wan edge 9.1 • oracle secure global desktop 5.6 • oracle utilities testing accelerator 6.0.0.1.1 • oracle utilities testing accelerator 6.0.0.2.2 • oracle utilities testing accelerator 6.0.0.3.1 • mcafee epolicy orchestrator (< 5.10.0) • mcafee epolicy orchestrator 5.10.0