Bug 1806849 (CVE-2019-17569) - CVE-2019-17569 tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling
Summary: CVE-2019-17569 tomcat: Regression in handling of Transfer-Encoding header all...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-17569
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1806851
TreeView+ depends on / blocked
 
Reported: 2020-02-25 07:13 UTC by Ted Jongseok Won
Modified: 2021-02-16 20:32 UTC (History)
82 users (show)

Fixed In Version: tomcat 9.0.31, tomcat 8.5.51, tomcat 7.0.100
Doc Type: If docs needed, set a value
Doc Text:
The refactoring in 9.0.28 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. It affects the versions of Apache Tomcat 9 (9.0.28 to 9.0.30), Tomcat 8 (8.5.48 to 8.5.50), and Tomcat 7 (7.0.98 to 7.0.99).
Clone Of:
Environment:
Last Closed: 2020-03-18 16:31:47 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:1520 0 None None None 2020-04-21 11:07:20 UTC
Red Hat Product Errata RHSA-2020:1521 0 None None None 2020-04-21 10:56:08 UTC

Description Ted Jongseok Won 2020-02-25 07:13:35 UTC 
The refactoring in 9.0.28 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

It affects the version of Apache Tomcat 9 from 9.0.28 to 9.0.30, Tomcat from 8 8.5.48 to 8.5.50, and Tomcat 7 7.0.98 to 7.0.99.

Upstream Patches:
https://github.com/apache/tomcat/commit/060ecc5 / tomcat9
https://github.com/apache/tomcat/commit/959f1df / tomcat8
https://github.com/apache/tomcat/commit/b191a0d / tomcat7
Comment 1 Ted Jongseok Won 2020-02-25 07:13:42 UTC 
Acknowledgments:

Name: @ZeddYu (Apache Tomcat Security Team)
Comment 2 Ted Jongseok Won 2020-02-25 07:13:46 UTC 
External References:

https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31
Comment 10 Mauro Matteo Cascella 2020-03-18 09:36:44 UTC 
Statement:

This flaw did not affect the versions of Tomcat as shipped with Red Enterprise Linux 5, 6, 7 and 8, as they did not include the vulnerable code, which was introduced in a later version of the package.

OpenDaylight in Red Hat OpenStack 10 & 13 was in technical preview status, because of this no fixes will be released for it.
Comment 12 Product Security DevOps Team 2020-03-18 16:31:47 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-17569
Comment 13 errata-xmlrpc 2020-04-21 10:56:02 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2020:1521 https://access.redhat.com/errata/RHSA-2020:1521
Comment 14 errata-xmlrpc 2020-04-21 11:07:14 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.3 on RHEL 7
  Red Hat JBoss Web Server 5.3 on RHEL 6
  Red Hat JBoss Web Server 5.3 on RHEL 8

Via RHSA-2020:1520 https://access.redhat.com/errata/RHSA-2020:1520
Note You need to log in before you can comment on or make changes to this bug.