Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding. Reference: https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E
Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1981534]
This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2021:4863 https://access.redhat.com/errata/RHSA-2021:4863
This issue has been addressed in the following products: Red Hat JBoss Web Server 5.6 on RHEL 7 Red Hat JBoss Web Server 5.6 on RHEL 8 Via RHSA-2021:4861 https://access.redhat.com/errata/RHSA-2021:4861
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-33037
This issue has been addressed in the following products: Red Hat Support for Spring Boot 2.5.10 Via RHSA-2022:1179 https://access.redhat.com/errata/RHSA-2022:1179
This issue has been addressed in the following products: Red Hat Fuse 7.11 Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532