Bugzilla – Bug 1164825
VUL-1: CVE-2019-17569: tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling
Last modified: 2020-08-19 11:35:53 UTC
rh#1806849 The refactoring in 9.0.28 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. It affects the version of Apache Tomcat 9 from 9.0.28 to 9.0.30, Tomcat from 8 8.5.48 to 8.5.50, and Tomcat 7 7.0.98 to 7.0.99. Upstream Patches: https://github.com/apache/tomcat/commit/060ecc5 / tomcat9 https://github.com/apache/tomcat/commit/959f1df / tomcat8 https://github.com/apache/tomcat/commit/b191a0d / tomcat7 References: https://bugzilla.redhat.com/show_bug.cgi?id=1806849 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17569 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17569 https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E
does not affect us I believe, would not mind a second opinion
SUSE-SU-2020:0598-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1164692,1164825,1164860 CVE References: CVE-2019-17569,CVE-2020-1935,CVE-2020-1938 Sources used: SUSE Linux Enterprise Server for SAP 15 (src): tomcat-9.0.31-3.42.2 SUSE Linux Enterprise Server 15-LTSS (src): tomcat-9.0.31-3.42.2 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): tomcat-9.0.31-3.42.2 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): tomcat-9.0.31-3.42.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0632-1: An update that fixes 6 vulnerabilities is now available. Category: security (important) Bug References: 1139924,1159723,1159729,1164692,1164825,1164860 CVE References: CVE-2019-10072,CVE-2019-12418,CVE-2019-17563,CVE-2019-17569,CVE-2020-1935,CVE-2020-1938 Sources used: SUSE Linux Enterprise Server 12-SP5 (src): tomcat-9.0.31-3.25.1 SUSE Linux Enterprise Server 12-SP4 (src): tomcat-9.0.31-3.25.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0631-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1164692,1164825,1164860 CVE References: CVE-2019-17569,CVE-2020-1935,CVE-2020-1938 Sources used: SUSE Linux Enterprise Module for Web Scripting 15-SP1 (src): tomcat-9.0.31-4.22.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): tomcat-9.0.31-4.22.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0345-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1164692,1164825,1164860 CVE References: CVE-2019-17569,CVE-2020-1935,CVE-2020-1938 Sources used: openSUSE Leap 15.1 (src): tomcat-9.0.31-lp151.3.12.1
Resolved.