~ / search / GHSA-qxf4-chvg-4r8r

GHSA-qxf4-chvg-4r8r

Potential HTTP request smuggling in Apache Tomcat

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-1935

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat.embed:tomcat-embed-core < 7.0.100 7.0.100
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.0.0, < 8.5.51 8.5.51
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0, < 9.0.31 9.0.31
Maven org.apache.tomcat:tomcat < 7.0.100 7.0.100
Maven org.apache.tomcat:tomcat >= 8.0.0, < 8.5.51 8.5.51
Maven org.apache.tomcat:tomcat >= 9.0.0, < 9.0.31 9.0.31

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

References

External links from the advisory. They lead to third-party sites.