Apache Tomcat may reject request containing invalid Content-Length header

🗓️ 01 Nov 2022 12:00:30Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 43 Views

Apache Tomcat rejecting invalid Content-Length heade

Reporter	Title	Published	Views	Family All 205
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server	31 Oct 202315:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat, Apache Commons FileUpload and Apache Axis might affect IBM Storage Copy Data Management	22 Mar 202416:05	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat is vulnerable to HTTP request smuggling (CVE-2022-42252)	19 Dec 202219:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Build is affected by CVE-2022-42252	20 Dec 202207:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	26 Mar 202503:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerability in Apache Tomcat	7 Nov 202407:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-42252	20 Jan 202316:11	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Commons Text 1.9	8 Dec 202204:10	–	ibm

Vulners

Node

org.apache.tomcat tomcat-coyoteRange10.1.0-M1–10.1.1maven

OR

org.apache.tomcat tomcat-coyoteRange10.0.0-M1–10.0.27maven

OR

org.apache.tomcat tomcat-coyoteRange9.0.0-M1–9.0.68maven

OR

org.apache.tomcat.embed tomcat-embed-coreRange10.1.0-M1–10.1.1maven

OR

org.apache.tomcat.embed tomcat-embed-coreRange10.0.0-M1–10.0.27maven

OR

org.apache.tomcat.embed tomcat-embed-coreRange9.0.0-M1–9.0.68maven

OR

org.apache.tomcat.embed tomcat-embed-coreRange8.5.0–8.5.83maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-42252
lists	www.lists.apache.org/thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq
security	www.security.gentoo.org/glsa/202305-37
github	www.github.com/apache/tomcat/commit/0d089a15047faf9cb3c82f80f4d28febd4798920
github	www.github.com/apache/tomcat/commit/4c7f4fd09d2cc1692112ef70b8ee23a7a037ae77
github	www.github.com/apache/tomcat/commit/a1c07906d8dcaf7957e5cc97f5cdbac7d18a205a
github	www.github.com/apache/tomcat/commit/c9fe754e5d17e262dfbd3eab2a03ca96ff372dc3
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-8.html
tomcat	www.tomcat.apache.org/security-9.html

23 Apr 2024 20:42Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.5

EPSS0.0029

SSVC

apache tomcat request rejection content-length header http headers security vulnerability