CVE-2019-17569

tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling

Severity Score

4.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

La refactorización presente en Apache Tomcat versiones 9.0.28 hasta 9.0.30, versiones 8.5.48 hasta 8.5.50 y versiones 7.0.98 hasta 7.0.99, introdujo una regresión. El resultado de la regresión fue que los encabezados Transfer-Encoding no válidos fueron procesados incorrectamente, conllevando a una posibilidad de Tráfico No Autorizado de Peticiones HTTP si Tomcat se encontraba detrás de un proxy inverso que manejaba incorrectamente el encabezado Transfer-Encoding no válido de una manera particular. Tal proxy inverso es considerado improbable.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector, the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 5.3 serves as a replacement for Red Hat JBoss Web Server 5.2, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References. Issues addressed include a privilege escalation vulnerability.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-10-14 CVE Reserved
2020-02-24 CVE Published
2024-08-05 CVE Updated
2025-05-04 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CAPEC

References (13)

URL	Tag	Source
https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.tomee.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743%40%3Ccommits.tomee.apache.org%3E	Mailing List
https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html	Mailing List
https://security.netapp.com/advisory/ntap-20200327-0005	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://www.oracle.com/security-alerts/cpujan2021.html	2023-11-07
https://www.oracle.com/security-alerts/cpujul2020.html	2023-11-07
https://www.oracle.com/security-alerts/cpuoct2020.html	2023-11-07

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html	2023-11-07
https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E	2023-11-07
https://www.debian.org/security/2020/dsa-4673	2023-11-07
https://www.debian.org/security/2020/dsa-4680	2023-11-07
https://access.redhat.com/security/cve/CVE-2019-17569	2020-04-21
https://bugzilla.redhat.com/show_bug.cgi?id=1806849	2020-04-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 7.0.98 <= 7.0.99 Search vendor "Apache" for product "Tomcat" and version " >= 7.0.98 <= 7.0.99"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 8.5.48 <= 8.5.50 Search vendor "Apache" for product "Tomcat" and version " >= 8.5.48 <= 8.5.50"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 9.0.28 <= 9.0.30 Search vendor "Apache" for product "Tomcat" and version " >= 9.0.28 <= 9.0.30"		-		Affected
Apache Search vendor "Apache"		Tomee Search vendor "Apache" for product "Tomee"				7.0.7 Search vendor "Apache" for product "Tomee" and version "7.0.7"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.1 Search vendor "Opensuse" for product "Leap" and version "15.1"		-		Affected
Netapp Search vendor "Netapp"		Data Availability Services Search vendor "Netapp" for product "Data Availability Services"				-		-		Affected
Netapp Search vendor "Netapp"		Oncommand System Manager Search vendor "Netapp" for product "Oncommand System Manager"				>= 3.0.0 <= 3.1.3 Search vendor "Netapp" for product "Oncommand System Manager" and version " >= 3.0.0 <= 3.1.3"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Oracle Search vendor "Oracle"		Agile Engineering Data Management Search vendor "Oracle" for product "Agile Engineering Data Management"				6.2.1.0 Search vendor "Oracle" for product "Agile Engineering Data Management" and version "6.2.1.0"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.3 Search vendor "Oracle" for product "Agile Plm" and version "9.3.3"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.5 Search vendor "Oracle" for product "Agile Plm" and version "9.3.5"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.6 Search vendor "Oracle" for product "Agile Plm" and version "9.3.6"		-		Affected
Oracle Search vendor "Oracle"		Communications Instant Messaging Server Search vendor "Oracle" for product "Communications Instant Messaging Server"				10.0.1.4.0 Search vendor "Oracle" for product "Communications Instant Messaging Server" and version "10.0.1.4.0"		-		Affected
Oracle Search vendor "Oracle"		Health Sciences Empirica Inspections Search vendor "Oracle" for product "Health Sciences Empirica Inspections"				1.0.1.2 Search vendor "Oracle" for product "Health Sciences Empirica Inspections" and version "1.0.1.2"		-		Affected
Oracle Search vendor "Oracle"		Health Sciences Empirica Signal Search vendor "Oracle" for product "Health Sciences Empirica Signal"				7.3.3 Search vendor "Oracle" for product "Health Sciences Empirica Signal" and version "7.3.3"		-		Affected
Oracle Search vendor "Oracle"		Hospitality Guest Access Search vendor "Oracle" for product "Hospitality Guest Access"				4.2.0 Search vendor "Oracle" for product "Hospitality Guest Access" and version "4.2.0"		-		Affected
Oracle Search vendor "Oracle"		Hospitality Guest Access Search vendor "Oracle" for product "Hospitality Guest Access"				4.2.1 Search vendor "Oracle" for product "Hospitality Guest Access" and version "4.2.1"		-		Affected
Oracle Search vendor "Oracle"		Instantis Enterprisetrack Search vendor "Oracle" for product "Instantis Enterprisetrack"				>= 17.1 <= 17.3 Search vendor "Oracle" for product "Instantis Enterprisetrack" and version " >= 17.1 <= 17.3"		-		Affected
Oracle Search vendor "Oracle"		Mysql Enterprise Monitor Search vendor "Oracle" for product "Mysql Enterprise Monitor"				<= 4.0.12 Search vendor "Oracle" for product "Mysql Enterprise Monitor" and version " <= 4.0.12"		-		Affected
Oracle Search vendor "Oracle"		Mysql Enterprise Monitor Search vendor "Oracle" for product "Mysql Enterprise Monitor"				>= 8.0.0 <= 8.0.20 Search vendor "Oracle" for product "Mysql Enterprise Monitor" and version " >= 8.0.0 <= 8.0.20"		-		Affected
Oracle Search vendor "Oracle"		Transportation Management Search vendor "Oracle" for product "Transportation Management"				6.3.7 Search vendor "Oracle" for product "Transportation Management" and version "6.3.7"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				12.2.0.1 Search vendor "Oracle" for product "Workload Manager" and version "12.2.0.1"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				18c Search vendor "Oracle" for product "Workload Manager" and version "18c"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				19c Search vendor "Oracle" for product "Workload Manager" and version "19c"		-		Affected