Redhat.comRH:CVE-2019-17569CVE-2019-17569
0.003 Low
EPSS
Percentile
71.6%
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
References
bugzilla.redhat.com/show_bug.cgi?id=1806849
nvd.nist.gov/vuln/detail/CVE-2019-17569
tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31
www.cve.org/CVERecord?id=CVE-2019-17569
Related
