Vulnerability in Apache Tomcat
CVE-2019-17569
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Vulnerability class: HTTP Request Smuggling
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.089 (95.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.089 · newest: 0.089 · change: 0.000
Affected products
- Apache Tomcat — versions Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50, 7.0.98 to 7.0.99
- Apache Tomcat
- Apache Tomee — versions 7.0.7
- NetApp Data Availability Services
- NetApp Oncommand System Manager
- Oracle Agile Engineering Data Management — versions 6.2.1.0
- Oracle Agile Plm — versions 9.3.3, 9.3.5, 9.3.6
- Oracle Agile Product Lifecycle Management — versions 9.3.3, 9.3.5, 9.3.6
- Oracle Communications Instant Messaging Server — versions 10.0.1.4.0
- Oracle Health Sciences Empirica Inspections — versions 1.0.1.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d500620… (Vendor Advisory, mailing-list, Mailing List)
- lists.debian.org/debian-lts-announce/2020/03/msg00006.html (mailing-list, Mailing List, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html (vendor-advisory, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0… (mailing-list)
- lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c8… (mailing-list)
- www.debian.org/security/2020/dsa-4673 (vendor-advisory, Third Party Advisory)
- www.debian.org/security/2020/dsa-4680 (vendor-advisory, Third Party Advisory)
- www.oracle.com/security-alerts/cpujul2020.html (Patch, Third Party Advisory)
- security.netapp.com/advisory/ntap-20200327-0005/ (Third Party Advisory)
- www.oracle.com/security-alerts/cpuoct2020.html (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-17569?
- CVE-2019-17569 is a medium-severity vulnerability in Apache Tomcat, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 4.8/10. Published 2020-02-24.
- How severe is CVE-2019-17569?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2019-17569 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.