Vulnerability · Published Feb 24, 2020 · Assigned by apache
CVE-2020-1935
Medium 4.8
In plain English
A medium-severity security flaw in Apache Tomcat from Apache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.4% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)9.4%top 4.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | tomcat9 | 9.0.31-1 | DEBIAN-CVE-2020-1935 |
| Debian:13 | tomcat9 | 9.0.31-1 | DEBIAN-CVE-2020-1935 |
| Debian:14 | tomcat9 | 9.0.31-1 | DEBIAN-CVE-2020-1935 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.51 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.31 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 7.0.100 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat:tomcat | 7.0.100 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat:tomcat | 9.0.31 | GHSA-qxf4-chvg-4r8r |
| Maven | org.apache.tomcat:tomcat | 8.5.51 | GHSA-qxf4-chvg-4r8r |
| Rocky Linux:8 | apache-commons-collections | 0:3.2.2-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | apache-commons-collections | 0:3.2.2-10.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | apache-commons-lang | 0:2.6-21.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | apache-commons-lang | 0:2.6-21.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | apache-commons-net | 0:3.6-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | apache-commons-net | 0:3.6-3.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | bea-stax | 0:1.2.0-16.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | glassfish-fastinfoset | 0:1.2.13-9.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | glassfish-jaxb | 0:2.2.11-11.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | glassfish-jaxb-api | 0:2.2.12-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | jackson-annotations | 0:2.10.0-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | jackson-core | 0:2.10.0-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | jackson-databind | 0:2.10.0-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | jackson-jaxrs-providers | 0:2.9.9-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | jackson-module-jaxb-annotations | 0:2.7.6-4.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | javassist | 0:3.18.1-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | javassist | 0:3.18.1-8.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | ldapjdk | 0:4.22.0-1.module+el8.4.0+418+b7ae1d4a | RLSA-2020:4847 |
| Rocky Linux:8 | pki-servlet-engine | 1:9.0.30-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | python-nss | 0:1.0.1-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | relaxngDatatype | 0:2011.1-7.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | resteasy | 0:3.0.26-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | slf4j | 0:1.7.25-4.module+el8.3.0+133+b8b54b58 | RLSA-2020:4847 |
| Rocky Linux:8 | slf4j | 0:1.7.25-4.module+el8.5.0+697+f586bb30 | RLSA-2020:4847 |
| Rocky Linux:8 | slf4j | 0:1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | stax-ex | 0:1.7.7-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | velocity | 0:1.7-24.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | velocity | 0:1.7-24.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | xalan-j2 | 0:2.7.1-38.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | xalan-j2 | 0:2.7.1-38.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | xerces-j2 | 0:2.11.0-34.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | xerces-j2 | 0:2.11.0-34.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | xml-commons-apis | 0:1.4.01-25.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | xml-commons-apis | 0:1.4.01-25.module+el8.5.0+697+f586bb30 | RLSA-2020:4847 |
| Rocky Linux:8 | xml-commons-apis | 0:1.4.01-25.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | xml-commons-resolver | 0:1.2-26.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux:8 | xml-commons-resolver | 0:1.2-26.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | xmlstreambuffer | 0:1.5.4-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux:8 | xsom | 0:0-19.20110809svn.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache | Apache Tomcat | Apache Tomcat 9.0.0.M1 to 9.0.308.5.0 to 8.5.507.0.0 to 7.0.99 |
References
- [tomcat-announce] 20200224 [SECURITY] CVE-2020-1935 HTTP Request Smuggling mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update mailing-list, x_refsource_MLIST
- openSUSE-SU-2020:0345 vendor-advisory, x_refsource_SUSE
- [tomee-commits] 20200320 [jira] [Created] (TOMEE-2790) TomEE plus(7.0.7) is affected by CVE-2020-1935 & CVE-2019-17569 vulnerabilities mailing-list, x_refsource_MLIST
- [tomee-commits] 20200323 [jira] [Commented] (TOMEE-2790) TomEE plus(7.0.7) is affected by CVE-2020-1935 & CVE-2019-17569 vulnerabilities mailing-list, x_refsource_MLIST
- DSA-4673 vendor-advisory, x_refsource_DEBIAN
- DSA-4680 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200327-0005/ x_refsource_CONFIRM
- [tomcat-users] 20200724 CVE-2020-1935 mailing-list, x_refsource_MLIST
- [tomcat-users] 20200724 Re: CVE-2020-1935 mailing-list, x_refsource_MLIST
- [tomcat-users] 20200724 RE: CVE-2020-1935 mailing-list, x_refsource_MLIST
- [tomcat-users] 20200726 Re: CVE-2020-1935 mailing-list, x_refsource_MLIST
- [tomcat-users] 20200727 RE: CVE-2020-1935 mailing-list, x_refsource_MLIST
- USN-4448-1 vendor-advisory, x_refsource_UBUNTU
- https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
- [tomcat-dev] 20210428 [Bug 65272] Problems proccessing HTTP request without CR in last versions mailing-list, x_refsource_MLIST