| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 7.0.98, < 7.0.100≥ 8.5.48, < 8.5.51≥ 9.0.28, < 9.0.31 | 7.0.1008.5.519.0.31 |
| org.apache.tomcat:tomcat | ≥ 7.0.98, < 7.0.100≥ 8.5.48, < 8.5.51≥ 9.0.28, < 9.0.31 | 7.0.1008.5.519.0.31 |
| tomcat | ≥ 7.0.98, ≤ 7.0.99≥ 8.5.48, ≤ 8.5.50≥ 9.0.28, ≤ 9.0.30 | |
| tomee | = 7.0.7 | |
| oncommand system manager | ≥ 3.0.0, ≤ 3.1.3 | |
| agile engineering data management | = 6.2.1.0 | |
| agile product lifecycle management | = 9.3.3= 9.3.5= 9.3.6 | |
| communications instant messaging server | = 10.0.1.4.0 | |
| health sciences empirica inspections | = 1.0.1.2 | |
| health sciences empirica signal | = 7.3.3 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| instantis enterprisetrack | ≥ 17.1, ≤ 17.3 | |
| mysql enterprise monitor | ≥ 8.0.0, ≤ 8.0.20≤ 4.0.12 | |
| transportation management | = 6.3.7 | |
| workload manager | = 12.2.0.1= 18c= 19c |
The refactoring present in Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free