CVE-2019-17569: XSS
Apache Tomcat is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Other sources
The refactoring in 9.0.28 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
It affects the version of Apache Tomcat 9 from 9.0.28 to 9.0.30, Tomcat from 8 8.5.48 to 8.5.50, and Tomcat 7 7.0.98 to 7.0.99.
Upstream Patches: https://github.com/apache/tomcat/commit/060ecc5 / tomcat9 https://github.com/apache/tomcat/commit/959f1df / tomcat8 https://github.com/apache/tomcat/commit/b191a0d / tomcat7
— Red Hat
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-17569?
CVE-2019-17569 is a vulnerability in Apache Tomcat that allows for HTTP request smuggling.
How severe is CVE-2019-17569?
CVE-2019-17569 has a severity rating of 6.5, which is considered medium.
What software versions are affected by CVE-2019-17569?
Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50, and 7.0.98 to 7.0.99 are affected by CVE-2019-17569.
How can I fix CVE-2019-17569?
To fix CVE-2019-17569, you should update Apache Tomcat to version 9.0.31, 8.5.51, or 7.0.100.
Where can I find more information about CVE-2019-17569?
You can find more information about CVE-2019-17569 on the Apache Tomcat GitHub page.