CVE-2020-1935: XSS
A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line (EOL) parsing that allowed some invalid HTTP headers to be parsed as valid. This led to the possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. The highest threat with this vulnerability is system availability.
Other sources
Apache Tomcat is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
The HTTP header parsing code used an approach to end-of-line (EOL) parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
It affects the version of Apache Tomcat 9 from 9.0.0.M1 to 9.0.30, Tomcat from 8 8.5.0 to 8.5.50, and Tomcat 7 7.0.0 to 7.0.99.
Upstream Patches: https://github.com/apache/tomcat/commit/8bfb0ff / tomcat9 https://github.com/apache/tomcat/commit/8fbe2e9 / tomcat8 https://github.com/apache/tomcat/commit/702bf15 / tomcat7
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-1935?
CVE-2020-1935 has a moderate severity level due to the potential for HTTP request smuggling.
How do I fix CVE-2020-1935?
To fix CVE-2020-1935, upgrade to Apache Tomcat version 7.0.100, 8.5.51, or 9.0.31 or later.
Which versions of Apache Tomcat are affected by CVE-2020-1935?
CVE-2020-1935 affects Apache Tomcat versions before 7.0.100, 8.5.51, and 9.0.31.
What is HTTP request smuggling related to CVE-2020-1935?
HTTP request smuggling involves sending maliciously crafted requests that can bypass security controls by exploiting the flawed header parsing.
Is CVE-2020-1935 applicable to reverse proxy configurations?
Yes, CVE-2020-1935 is particularly concerning when Tomcat is deployed behind a reverse proxy that does not handle headers correctly.