GHSA-4vww-mc66-62m6

    Dashboard / Vulnerabilities / GHSA-4vww-mc66-62m6

    GHSA-4vww-mc66-62m6

    Published: 13 Aug 2021Last Modified: 11 Mar 2024

    Summary: HTTP Request Smuggling in Apache Tomcat

    Details: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-33037, https://github.com/apache/tomcat/commit/05f9e8b00f5d9251fcd3c95dcfd6cf84177f46c8, https://github.com/apache/tomcat/commit/19d11556d0db99df291df33605f137976d152475, https://github.com/apache/tomcat/commit/3202703e6d635e39b74262e81f0cb4bcbe2170dc, https://github.com/apache/tomcat/commit/45d70a86a901cbd534f8f570bed2aec9f7f7b88e, https://github.com/apache/tomcat/commit/506134f957a4be2c5b4a9334f7b3435fc954dbc1, https://github.com/apache/tomcat/commit/8874fa02e9b36baa9ca6b226c0882c0190ca5a02, https://github.com/apache/tomcat/commit/a2c3dc4c96168743ac0bab613709a5bbdaec41d0, https://github.com/apache/tomcat/commit/da0e7cb093cf68b052d9175e469dbd0464441b0b, https://github.com/apache/tomcat/commit/eee0d024c1b3171560c92eaba79dd6eb8eb11bcd, https://security.gentoo.org/glsa/202208-34, https://security.netapp.com/advisory/ntap-20210827-0007, https://tomcat.apache.org/security-10.html, https://tomcat.apache.org/security-8.html, https://tomcat.apache.org/security-9.html, https://www.debian.org/security/2021/dsa-4952, https://www.oracle.com//security-alerts/cpujul2021.html, https://www.oracle.com/security-alerts/cpuapr2022.html, https://www.oracle.com/security-alerts/cpujan2022.html, https://www.oracle.com/security-alerts/cpuoct2021.html, https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html, https://lists.apache.org/thread/kovg1bft77xo34ksrcskh5nl50p69962, https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97@%3Ccommits.tomee.apache.org%3E, https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7@%3Ccommits.tomee.apache.org%3E, https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2@%3Ccommits.tomee.apache.org%3E, https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37@%3Ccommits.tomee.apache.org%3E, https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E, https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262@%3Ccommits.tomee.apache.org%3E, https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b@%3Ccommits.tomee.apache.org%3E, https://kc.mcafee.com/corporate/index?page=content&id=SB10366, https://github.com/apache/tomcat

    Affected packages

    Package

    Name: org.apache.tomcat:tomcat

    Purl: pkg:maven/org.apache.tomcat/tomcat

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 10.0.0-M1
    Fixed -10.0.7

    Affected versions

    10.0.0
    10.0.0-M1
    10.0.0-M10
    10.0.0-M3
    10.0.0-M4
    10.0.0-M5
    10.0.0-M6
    10.0.0-M7
    10.0.0-M8
    10.0.0-M9
    10.0.2
    10.0.4
    10.0.5
    10.0.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-4vww-mc66-62m6 | CVE-DB