60
CVE-2019-17569
—CVSS 3.1
4.8 medium
EPSS
9%p95
Published
()
Modified
Description
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
- Vendors
- apacheopensusenetappdebianoracle
- Products
- tomcat, tomee, leap, data availability services, oncommand system manager, debian linux, agile engineering data management, agile product lifecycle management, communications instant messaging server, health sciences empirica inspections, health sciences empirica signal, hospitality guest access
- Weakness
- CWE-444
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N