Medium · published July 12, 2021
CVSS calls it medium at 5.3. It sits in the 99.5th percentile for exploit probability.
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 8.5.0, ≤ 8.5.66 | — |
| apache/tomcat | > 9.0.0, ≤ 9.0.46 | — |
| apache/tomcat | > 10.0.0, ≤ 10.0.6 | — |
| apache/tomee | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/communications_cloud_native_core_policy | all versions | — |
| oracle/communications_cloud_native_core_service_communication_proxy | all versions | — |
| oracle/communications_diameter_signaling_router | ≥ 8.0.0.0, ≤ 8.5.0.2 | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_policy_management | all versions | — |
| oracle/communications_pricing_design_center | all versions | — |
| oracle/communications_session_report_manager | ≥ 8.0.0, ≤ 8.2.4.0 | — |
| oracle/communications_session_route_manager | ≥ 8.0.0, ≤ 8.2.4 | — |
| oracle/graph_server_and_client | < 21.4 | 21.4 |
| oracle/healthcare_translational_research | all versions | — |
| oracle/hospitality_cruise_shipboard_property_management_system | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/managed_file_transfer | all versions | — |
| oracle/managed_file_transfer | all versions | — |
| oracle/mysql_enterprise_monitor | ≤ 8.0.25 | — |
| oracle/sd-wan_edge | all versions | — |
| oracle/sd-wan_edge | all versions | — |
| oracle/secure_global_desktop | all versions | — |
| oracle/utilities_testing_accelerator | all versions | — |
| oracle/utilities_testing_accelerator | all versions | — |
| oracle/utilities_testing_accelerator | all versions | — |
| mcafee/epolicy_orchestrator | < 5.10.0 | 5.10.0 |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |
| mcafee/epolicy_orchestrator | all versions | — |