GoogleOSV:GHSA-R6J3-PX5G-CQ3XApache Tomcat Improper Input Validation vulnerability
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
0.002 Low
EPSS
Percentile
60.6%
Improper Input Validation vulnerability in Apache Tomcat.
Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single
request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.
Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
References
www.openwall.com/lists/oss-security/2023/10/10/10
github.com/apache/tomcat
github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0
github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4
github.com/apache/tomcat/commit/c83fe47725f7ae9ae213568d9039171124fb7ec6
github.com/apache/tomcat/commit/eb5c094e5560764cda436362254997511a3ca1f6
lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp
lists.debian.org/debian-lts-announce/2023/10/msg00020.html
nvd.nist.gov/vuln/detail/CVE-2023-45648
security.netapp.com/advisory/ntap-20231103-0007
www.debian.org/security/2023/dsa-5521
www.debian.org/security/2023/dsa-5522
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
0.002 Low
EPSS
Percentile
60.6%