Vulnerability from bitnami_vulndb
Published
2024-03-06 11:11
Modified
2025-11-06 13:25
Summary
Details

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "tomcat",
        "purl": "pkg:bitnami/tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.100"
            },
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "8.5.51"
            },
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.31"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-1935"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
      "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.",
  "id": "BIT-tomcat-2020-1935",
  "modified": "2025-11-06T13:25:46.476Z",
  "published": "2024-03-06T11:11:33.381Z",
  "references": [
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r127f76181aceffea2bd4711b03c595d0f115f63e020348fe925a916c%40%3Cannounce.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r441c1f30a252bf14b07396286f6abd8089ce4240e91323211f1a2d75%40%3Cusers.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r660cd379afe346f10d72c0eaa8459ccc95d83aff181671b7e9076919%40%3Cusers.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.tomee.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r80e9c8417c77d52c62809168b96912bda70ddf7748f19f8210f745b1%40%3Cusers.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r9ce7918faf347e7aac32be930bf26c233b0b140fe37af0bb294158b6%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra5dee390ad2d60307b8362505c059cd6a726de4d146d63dfce1e05e7%40%3Cusers.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743%40%3Ccommits.tomee.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd547be0c9d821b4b1000a694b8e58ef9f5e2d66db03a31dfe77c4b18%40%3Cusers.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20200327-0005/"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4448-1/"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4673"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4680"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1935"
    }
  ],
  "schema_version": "1.5.0"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.