QwikSec

Security Database

CVE

CWE

Training

CVE-2019-17569

Published: Feb 24, 2020

Modified: Aug 5, 2024

PUBLISHED

Description

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Vendor	Product	Versions
Apache	Apache Tomcat	affected `Apache Tomcat 9.0.28 to 9.0.30` affected `8.5.48 to 8.5.50` affected `7.0.98 to 7.0.99`

References

[tomcat-announce] 20200224 [SECURITY] CVE-2019-17569 HTTP Request Smuggling

mailing-list

x_refsource_MLIST

[debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update

mailing-list

x_refsource_MLIST

openSUSE-SU-2020:0345

vendor-advisory

x_refsource_SUSE

[tomee-commits] 20200320 [jira] [Created] (TOMEE-2790) TomEE plus(7.0.7) is affected by CVE-2020-1935 & CVE-2019-17569 vulnerabilities

mailing-list

x_refsource_MLIST

[tomee-commits] 20200323 [jira] [Commented] (TOMEE-2790) TomEE plus(7.0.7) is affected by CVE-2020-1935 & CVE-2019-17569 vulnerabilities

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_DEBIAN

vendor-advisory

x_refsource_DEBIAN

https://www.oracle.com/security-alerts/cpujul2020.html

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20200327-0005/

x_refsource_CONFIRM

https://www.oracle.com/security-alerts/cpuoct2020.html

x_refsource_MISC

https://www.oracle.com/security-alerts/cpujan2021.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.