| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 8.0.0, < 8.5.51≥ 9.0.0, < 9.0.31< 7.0.100 | 8.5.519.0.317.0.100 |
| org.apache.tomcat:tomcat | ≥ 8.0.0, < 8.5.51≥ 9.0.0, < 9.0.31< 7.0.100 | 8.5.519.0.317.0.100 |
| tomcat | = 9.0.0≥ 7.0.0, ≤ 7.0.99≥ 8.5.0, ≤ 8.5.50≥ 9.0.0, ≤ 9.0.30 | |
| oncommand system manager | ≥ 3.0.0, ≤ 3.1.3 | |
| agile engineering data management | = 6.2.1.0 | |
| agile product lifecycle management | = 9.3.3= 9.3.5= 9.3.6 | |
| communications element manager | = 8.1.1= 8.2.0= 8.2.1 | |
| communications instant messaging server | = 10.0.1.4.0 | |
| health sciences empirica inspections | = 1.0.1.2 | |
| health sciences empirica signal | = 7.3.3 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| hyperion infrastructure technology | = 11.1.2.4 | |
| instantis enterprisetrack | ≥ 17.1, ≤ 17.3 | |
| mysql enterprise monitor | ≥ 4.0.0, ≤ 4.0.12≥ 8.0.0, ≤ 8.0.20 | |
| retail order broker | = 15.0 | |
| siebel ui framework | ≤ 20.5 | |
| transportation management | = 6.3.7 | |
| workload manager | = 12.2.0.1= 18c= 19c |
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free