Inconsistent interpretation of HTTP requests in Apache Tomcat - CVE-2019-17569

Vulnerability identifier: #VU25806

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17569

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to improper input validation when processing a Transfer-Encoding headers. A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.

Apache Tomcat
Cloud Foundry UAA
Amazon Linux AMI
Oracle Solaris
Opensuse
tomcat8 (Debian package)
tomcat9 (Debian package)
CF Deployment
Oracle Database Server

Install updates from vendor's website.

Apache Tomcat - addressed in versions 7.0.100, 8.5.51, 9.0.31
tomcat8 (Debian package) - update to 8.5.54-0+deb9u1
tomcat9 (Debian package) - update to 9.0.31-1~deb10u1
CF Deployment - update to 12.40.0
Cloud Foundry UAA - update to 74.16.0

• https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html

• Multiple vulnerabilities in Apache Tomcat
• Amazon Linux AMI update for tomcat8
• Amazon Linux AMI update for tomcat7
• OpenSUSE Linux update for tomcat
• Cloud Foundry UAA update for Apache Tomcat
• Oracle Solaris update for third party packages
• Debian update for tomcat8
• Debian update for tomcat9
• Multiple vulnerabilities in Oracle Database Server