REDHAT-BUG-2440437: Input Validation
Improper Input Validation vulnerability in Apache Tomcat.
Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.
Older, EOL versions are also affected.
Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.15 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.50 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.113
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2440437?
The severity of REDHAT-BUG-2440437 is considered high due to improper input validation allowing unauthorized access.
How do I fix REDHAT-BUG-2440437?
To fix REDHAT-BUG-2440437, update Apache Tomcat to the latest version that addresses this vulnerability.
What versions of Apache Tomcat are affected by REDHAT-BUG-2440437?
Apache Tomcat versions 9.0.0-M1 to 9.0.112, 10.1.0-M1 to 10.1.49, and 11.0.0-M1 to 11.0.14 are affected by REDHAT-BUG-2440437.
What types of requests can exploit REDHAT-BUG-2440437?
REDHAT-BUG-2440437 can be exploited by sending HTTP/0.9 requests, which bypass security constraints.
Are there any workarounds for REDHAT-BUG-2440437?
Currently, the recommended workaround for REDHAT-BUG-2440437 is to limit HTTP/0.9 support in your Apache Tomcat configuration.