REDHAT-BUG-2457040: Low severity Apache Tomcat vulnerability
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.20 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.52 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.116
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2457040?
The severity of REDHAT-BUG-2457040 is low.
What does REDHAT-BUG-2457040 affect?
REDHAT-BUG-2457040 affects various versions of Apache Tomcat, specifically versions from 11.0.0-M1 to 11.0.18, 10.1.0-M1 to 10.1.52, 9.0.0.M1 to 9.0.115, and 8.5.0 to 8.5.100.
How does REDHAT-BUG-2457040 exploit vulnerabilities?
REDHAT-BUG-2457040 exploits vulnerabilities through inconsistent interpretation of HTTP requests, specifically related to HTTP request/response smuggling via invalid chunk extensions.
How can I mitigate REDHAT-BUG-2457040?
To mitigate REDHAT-BUG-2457040, it is recommended to upgrade to a patched version of Apache Tomcat that addresses this vulnerability.
Is REDHAT-BUG-2457040 relevant for my installation?
REDHAT-BUG-2457040 is relevant if you are running affected versions of Apache Tomcat, as it poses a risk of HTTP request/response smuggling.