CVE-2013-4286: Input Validation
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
Other sources
The Tomcat fix for CVE-2005-2090 was not complete. It did not cover the following cases:
- content-length header with chunked encoding over any HTTP connector - multiple content-length headers over any AJP connector
Requests with multiple content-length headers or with a content-length header when chunked encoding is being used should be rejected as invalid. When multiple components (firewalls, caches, proxies and Tomcat) process a sequence of requests where one or more requests contain either multiple content-length headers or a content-length header when chunked encoding is being used and several components do not reject the request and make different decisions as to which content-length header to use an attacker can poison a web-cache, perform an XSS attack and obtain sensitive information from requests other then their own. Tomcat now rejects requests with multiple content-length headers or with a content-length header when chunked encoding is being used.
This has been corrected in upstream versions 8.0.0-rc3 [1], 7.0.47 [2], and 6.0.39 [3].
[1] http://svn.apache.org/viewvc?view=revision&revision=1521829 [2] http://svn.apache.org/viewvc?view=revision&revision=1521854 [3] http://svn.apache.org/viewvc?view=revision&revision=1552565
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4286?
CVE-2013-4286 has a medium severity rating, affecting the proper handling of HTTP request headers in Apache Tomcat.
What versions of Apache Tomcat are affected by CVE-2013-4286?
CVE-2013-4286 affects Apache Tomcat versions before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3.
How do I fix CVE-2013-4286?
To mitigate CVE-2013-4286, users should upgrade to Apache Tomcat version 6.0.39, 7.0.47, or 8.0.0-RC3 or later.
What types of attacks can exploit CVE-2013-4286?
CVE-2013-4286 can be exploited by remote attackers to manipulate request header parsing, possibly leading to request smuggling.
Is there a workaround for CVE-2013-4286 if I can't upgrade?
No specific workaround is provided for CVE-2013-4286, so upgrading to a patched version is strongly recommended.