https://seclists.org/oss-sec/2023/q4/79: CVE-2023-45648: Apache Tomcat: Trailer header parsing too lenient
Published Oct 10, 2023
·Updated
Affected Software
4 affected components
Apache Tomcat>=11.0.0-M1<=11.0.0-M11
Apache Tomcat>=10.1.0-M1<=10.1.13
Apache Tomcat>=9.0.0-M1<=9.0.81
Apache Tomcat>=8.5.0<=8.5.93
Frequently Asked Questions
1
When is this issue exploitable in practice?
The issue can lead to request smuggling when an affected Tomcat instance is deployed behind a reverse proxy. Exploitation requires an attacker to send a crafted request containing an invalid trailer header.
2
Which Tomcat releases are affected?
Affected releases are Tomcat 11.0.0-M1 through 11.0.0-M11, 10.1.0-M1 through 10.1.13, 9.0.0-M1 through 9.0.81, and 8.5.0 through 8.5.93.