Vulnerability in Apache Tomcat
CVE-2020-1935
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Vulnerability class: HTTP Request Smuggling
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.094 (95.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.094 · newest: 0.094 · change: 0.000
Affected products
- Apache Tomcat — versions Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50, 7.0.0 to 7.0.99
- Apache Tomcat — versions 9.0.0
- NetApp Data Availability Services
- NetApp Oncommand System Manager
- Oracle Agile Engineering Data Management — versions 6.2.1.0
- Oracle Agile Product Lifecycle Management — versions 9.3.3, 9.3.5, 9.3.6
- Oracle Communications Element Manager — versions 8.1.1, 8.2.0, 8.2.1
- Oracle Communications Instant Messaging Server — versions 10.0.1.4.0
- Oracle Health Sciences Empirica Inspections — versions 1.0.1.2
- Oracle Health Sciences Empirica Signal — versions 7.3.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/r127f76181aceffea2bd4711b03c595d0f115f63e020348fe9… (Vendor Advisory, mailing-list, Mailing List)
- lists.debian.org/debian-lts-announce/2020/03/msg00006.html (mailing-list, Mailing List, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html (vendor-advisory, Mailing List, Third Party Advisory, Broken Link)
- lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0… (mailing-list)
- lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c8… (mailing-list)
- www.debian.org/security/2020/dsa-4673 (vendor-advisory, Third Party Advisory)
- www.debian.org/security/2020/dsa-4680 (vendor-advisory, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2020/05/msg00026.html (mailing-list, Mailing List, Third Party Advisory)
- www.oracle.com/security-alerts/cpujul2020.html (Third Party Advisory)
- security.netapp.com/advisory/ntap-20200327-0005/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-1935?
- CVE-2020-1935 is a medium-severity vulnerability in Apache Tomcat, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 4.8/10. Published 2020-02-24.
- How severe is CVE-2020-1935?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2020-1935 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.