CVE-2021-33037 Incorrect Transfer-Encoding handling with HTTP/1.0

🗓️ 12 Jul 2021 14:55:15Reported by apacheType

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 has incorrect Transfer-Encoding handling, leading to HTTP request smugglin

Reporter	Title	Published	Views	Family All 202
IBM Security Bulletins	Security Bulletin: Bulletin: App Connect Professional is affected by Apache Tomcat vulnerabilities.	28 Sep 202112:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Build is affected by CVE-2021-33037	9 Feb 202216:28	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2021-33037 Apache Tomcat 8.5.66 did not correctly parse the HTTP transfer-encoding request header leading to the possibility to request smuggling when used with a reverse proxy	1 Sep 202119:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge is affected by Apache Tomcat version used in it. (CVE-2021-33037)	7 Jul 202216:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem V9000 products	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2021-33037	25 Jan 202207:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	11 Oct 202118:12	–	ibm
Tenable Nessus	Apache Tomcat < 9.0.48 Vulnerability	12 Jul 202100:00	–	nessus
Tenable Nessus	Apache Tomcat < 8.5.68 Vulnerability	12 Jul 202100:00	–	nessus

[
  {
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Tomcat 10 10.0.0-M1 to 10.0.6"
      },
      {
        "status": "affected",
        "version": "Apache Tomcat 9 9.0.0.M1 to 9.0.46"
      },
      {
        "status": "affected",
        "version": "Apache Tomcat 8 8.5.0 to 8.5.66"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E
lists	www.lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E
security	www.security.gentoo.org/glsa/202208-34
lists	www.lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E
lists	www.lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E
security	www.security.netapp.com/advisory/ntap-20210827-0007/
oracle	www.oracle.com//security-alerts/cpujul2021.html
lists	www.lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E
oracle	www.oracle.com/security-alerts/cpujan2022.html
lists	www.lists.debian.org/debian-lts-announce/2021/08/msg00009.html

21 Aug 2022 04:07Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.75353

CWE-444