Bug 1164825 - (CVE-2019-17569) VUL-1: CVE-2019-17569: tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling
(CVE-2019-17569)
VUL-1: CVE-2019-17569: tomcat: Regression in handling of Transfer-Encoding he...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/253708/
CVSSv2:NVD:CVE-2019-17569:5.8:(AV:N/...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-02-25 12:05 UTC by Robert Frohl
Modified: 2020-08-19 11:35 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2020-02-25 12:05:02 UTC
rh#1806849

The refactoring in 9.0.28 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

It affects the version of Apache Tomcat 9 from 9.0.28 to 9.0.30, Tomcat from 8 8.5.48 to 8.5.50, and Tomcat 7 7.0.98 to 7.0.99.

Upstream Patches:
https://github.com/apache/tomcat/commit/060ecc5 / tomcat9
https://github.com/apache/tomcat/commit/959f1df / tomcat8
https://github.com/apache/tomcat/commit/b191a0d / tomcat7

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1806849
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17569
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17569
https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E
Comment 1 Robert Frohl 2020-02-25 12:07:09 UTC
does not affect us I believe, would not mind a second opinion
Comment 6 Swamp Workflow Management 2020-03-05 20:39:57 UTC
SUSE-SU-2020:0598-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1164692,1164825,1164860
CVE References: CVE-2019-17569,CVE-2020-1935,CVE-2020-1938
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    tomcat-9.0.31-3.42.2
SUSE Linux Enterprise Server 15-LTSS (src):    tomcat-9.0.31-3.42.2
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    tomcat-9.0.31-3.42.2
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    tomcat-9.0.31-3.42.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2020-03-10 17:14:28 UTC
SUSE-SU-2020:0632-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1139924,1159723,1159729,1164692,1164825,1164860
CVE References: CVE-2019-10072,CVE-2019-12418,CVE-2019-17563,CVE-2019-17569,CVE-2020-1935,CVE-2020-1938
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    tomcat-9.0.31-3.25.1
SUSE Linux Enterprise Server 12-SP4 (src):    tomcat-9.0.31-3.25.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2020-03-10 17:28:29 UTC
SUSE-SU-2020:0631-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1164692,1164825,1164860
CVE References: CVE-2019-17569,CVE-2020-1935,CVE-2020-1938
Sources used:
SUSE Linux Enterprise Module for Web Scripting 15-SP1 (src):    tomcat-9.0.31-4.22.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    tomcat-9.0.31-4.22.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-03-15 20:13:44 UTC
openSUSE-SU-2020:0345-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1164692,1164825,1164860
CVE References: CVE-2019-17569,CVE-2020-1935,CVE-2020-1938
Sources used:
openSUSE Leap 15.1 (src):    tomcat-9.0.31-lp151.3.12.1
Comment 11 Wolfgang Frisch 2020-08-19 11:35:53 UTC
Resolved.