CVE-2022-42252

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false the default for 8.5.x only, Tomcat did not reject a request containing an invalid Content-Length header making a...

CVE-2022-42252 Apache Tomcat request smuggling via malformed content-length

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false the default for 8.5.x only, Tomcat did not reject a request containing an invalid Content-Length header making a...

Apache Tomcat 环境问题漏洞

Apache Tomcat is a lightweight Web application server from the Apache Foundation. The program implements support for Servlet and JavaServer Page JSP. Apache Tomcat has an environment problem vulnerability that stems from the fact that Tomcat may have a request smuggling problem Request Smuggling...

Debian DSA-5265-1 : tomcat9 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5265 advisory. - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a an attacker is able to control the...

[SECURITY] [DSA 5265-1] tomcat9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5265-1 [email protected] https://www.debian.org/security/ Markus Koschany October 29, 2022 https://www.debian.org/security/faq -...

[SECURITY] [DLA 3160-1] tomcat9 security update

Debian LTS Advisory DLA-3160-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany October 26, 2022 https://wiki.debian.org/LTS Package : tomcat9 Version : 9.0.31-1deb10u7 CVE ID : CVE-2021-43980 CVE-2022-23181 CVE-2022-29885 Several security vulnerabilities have been...

Oracle MySQL Enterprise Monitor (Oct 2022 CPU)

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory. - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL component: Monitoring: General Moment.js. Supported versions that...

Budworm Attackers Return with New Espionage Strikes Against the United States

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The Budworm espionage group exploited Log4j vulnerabilities to jeopardize the Apache Tomcat service by integrating several custom and publicly available tools to exfiltrate sensitive information...

Fixed in Apache Tomcat 8.5.83

Low: Apache Tomcat request smuggling CVE-2022-42252 If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false the default, Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was...

Fixed in Apache Tomcat 10.1.1

Low: Apache Tomcat request smuggling CVE-2022-42252 If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false not the default, Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat wa...

PT-2022-6037

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.82 Apache Tomcat versions 9.0.0-M1 through 9.0.67 Apache Tomcat versions 10.0.0-M1 through 10.0.26 Apache Tomcat versions 10.1.0-M1 through 10.1.0 Description The issue is related to the implementation ...

KLA20033 SB vulnerability in Apache Tomcat

Security vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories Apache Tomcat 8.x vulnerabilities Apache Tomcat 10.1.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-42252 critical Solution...

KLA20034 SB vulnerability in Apache Tomcat

Security vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories Apache Tomcat 10.0.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-42252 critical Solution Update to the latest version Tomcat...

Fixed in Apache Tomcat 10.0.27

Low: Apache Tomcat request smuggling CVE-2022-42252 If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false not the default, Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat wa...

KLA20032 SB vulnerability in Apache Tomcat

Security vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories Apache Tomcat 9.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-42252 critical Solution Update to the latest version Tomcat 9.0...

Fixed in Apache Tomcat 9.0.68

Low: Apache Tomcat request smuggling CVE-2022-42252 If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false not the default, Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat wa...

Apache Tomcat 10.1.0-M1 < 10.1.0-M14 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.77, 9.0.0-M1 to 9.0.60, 10.0.0-M1 to 10.0.18 or 10.1.0-M1 to 10.1.0-M12. It is, therefore, affected by a information disclosure vulnerability. The simplified implementation of blocking reads and writes introduced in Tomcat ...

Apache Tomcat 8.5.x < 8.5.78 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.77, 9.0.0-M1 to 9.0.60, 10.0.0-M1 to 10.0.18 or 10.1.0-M1 to 10.1.0-M12. It is, therefore, affected by a information disclosure vulnerability. The simplified implementation of blocking reads and writes introduced in Tomcat ...

Apache Tomcat 10.0.0-M1 < 10.0.20 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.77, 9.0.0-M1 to 9.0.60, 10.0.0-M1 to 10.0.18 or 10.1.0-M1 to 10.1.0-M12. It is, therefore, affected by a information disclosure vulnerability. The simplified implementation of blocking reads and writes introduced in Tomcat ...

Apache Tomcat 9.0.0-M1 < 9.0.62 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.77, 9.0.0-M1 to 9.0.60, 10.0.0-M1 to 10.0.18 or 10.1.0-M1 to 10.1.0-M12. It is, therefore, affected by a information disclosure vulnerability. The simplified implementation of blocking reads and writes introduced in Tomcat ...