{
"id": "GHSA-767j-jfh2-jvrc",
"aliases": [
"CVE-2019-17569"
],
"details": "The refactoring present in Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.",
"summary": "Potential HTTP request smuggling in Apache Tomcat",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.98"
},
{
"fixed": "7.0.100"
}
]
}
],
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.48"
},
{
"fixed": "8.5.51"
}
]
}
],
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.28"
},
{
"fixed": "9.0.31"
}
]
}
],
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.98"
},
{
"fixed": "7.0.100"
}
]
}
],
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.48"
},
{
"fixed": "8.5.51"
}
]
}
],
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.28"
},
{
"fixed": "9.0.31"
}
]
}
],
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven"
}
}
],
"modified": "2022-09-08T14:06:08Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"published": "2020-02-28T01:10:58Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17569",
"type": "ADVISORY"
},
{
"url": "https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78@%3Ccommits.tomee.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743@%3Ccommits.tomee.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html",
"type": "WEB"
},
{
"url": "https://security.netapp.com/advisory/ntap-20200327-0005",
"type": "WEB"
},
{
"url": "https://www.debian.org/security/2020/dsa-4673",
"type": "WEB"
},
{
"url": "https://www.debian.org/security/2020/dsa-4680",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2021.html",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2020.html",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"type": "WEB"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2020-02-24T22:15:00Z",
"github_reviewed_at": "2020-02-25T16:19:11Z"
}
}