Inconsistent interpretation of HTTP requests in Apache Tomcat - CVE-2020-1935

Vulnerability identifier: #VU25807

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1935

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to the HTTP header parsing code uses an approach to end-of-line parsing that allows some invalid HTTP headers to be parsed as valid. A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.

Apache Tomcat
Cloud Foundry UAA
Amazon Linux AMI
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
CentOS
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Oracle Solaris
Opensuse
Ubuntu
Dell Support Assist Enterprise
IBM Engineering Requirements Management DOORS Next
Storage Copy Data Management
tomcat (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
tomcat8 (Debian package)
tomcat9 (Debian package)
libtomcat8-java (Ubuntu package)
tomcat8 (Ubuntu package)
CF Deployment

Install updates from vendor's website.

Apache Tomcat - addressed in versions 7.0.100, 8.5.51, 9.0.31
Dell Support Assist Enterprise - update to 4.00.06.00
tomcat (Red Hat package) - addressed in versions 7.0.76-11.el7_6, 7.0.76-12.el7_7, 7.0.76-16.el7_9
tomcat8 (Debian package) - update to 8.5.54-0+deb9u1
tomcat9 (Debian package) - update to 9.0.31-1~deb10u1
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
CF Deployment - update to 12.40.0
Cloud Foundry UAA - update to 74.16.0
Storage Copy Data Management - update to 2.2.26.0
libtomcat8-java (Ubuntu package) - update to 8.0.32-1ubuntu1.13
tomcat8 (Ubuntu package) - update to 8.0.32-1ubuntu1.13

• https://lists.apache.org/thread.html/r127f76181aceffea2bd4711b03c595d0f115f63e020348fe925a916c%40%3Cannounce.tomcat.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html

• Multiple vulnerabilities in Apache Tomcat
• Amazon Linux AMI update for tomcat8
• Amazon Linux AMI update for tomcat7
• OpenSUSE Linux update for tomcat
• Cloud Foundry UAA update for Apache Tomcat
• Oracle Solaris update for third party packages
• Debian update for tomcat8
• Debian update for tomcat9
• Red Hat Enterprise Linux 7 update for tomcat
• CentOS 7 update for tomcat
• Amazon Linux AMI update for tomcat7
• Amazon Linux AMI update for tomcat7
• Red Hat Enterprise Linux 7.6 update for tomcat
• Red Hat Enterprise Linux 7.7 update for tomcat
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Ubuntu update for tomcat8
• Multiple vulnerabilities in IBM Storage Copy Data Management