PT-2020-3259 · Apache+6 · Apache Tomcat+6
Khuyen Nguyen
·
Published
2020-02-11
·
Updated
2026-05-18
·
CVE-2020-1935
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 7.0.0 through 7.0.99
Apache Tomcat versions 8.5.0 through 8.5.50
Apache Tomcat versions 9.0.0.M1 through 9.0.30
Description
The issue is related to the HTTP header parsing code, which used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid
Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.Recommendations
For Apache Tomcat versions 7.0.0 through 7.0.99, update to a version that fixes the HTTP header parsing issue.
For Apache Tomcat versions 8.5.0 through 8.5.50, update to a version that fixes the HTTP header parsing issue.
For Apache Tomcat versions 9.0.0.M1 through 9.0.30, update to a version that fixes the HTTP header parsing issue.
As a temporary workaround, consider restricting access to the
Transfer-Encoding header in the reverse proxy configuration to minimize the risk of exploitation.Exploit
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Tomcat
Centos
Red Hat
Rocky Linux
Suse
Ubuntu