Orta CVSS 5.3

CVE-2021-33037: Tomcat: güvenlik açığı

Yayın: 12 Temmuz 2021 18:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Özet bilgiler

Ürün: Apache Tomcat
CVSS v3.1: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: %74,67 (yüzdelik 100)
CWE: CWE-444
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-tomcat	8.5.0	8.5.66	—
apache-tomcat	9.0.0	9.0.46	—
apache-tomcat	10.0.0	10.0.6	—
apache-tomee	8.0.6	8.0.6	—
debian-debian-linux	9.0	9.0	—
debian-debian-linux	10.0	10.0	—
oracle-agile-product-lifecycle-management	9.3.6	9.3.6	—
oracle-communications-cloud-native-core-policy	1.14.0	1.14.0	—
oracle-communications-cloud-native-core-service-communication-proxy	1.14.0	1.14.0	—
oracle-communications-diameter-signaling-router	8.0.0.0	8.5.0.2	—
oracle-communications-instant-messaging-server	10.0.1.5.0	10.0.1.5.0	—
oracle-communications-policy-management	12.5.0	12.5.0	—
oracle-communications-pricing-design-center	12.0.0.3.0	12.0.0.3.0	—
oracle-communications-session-report-manager	8.0.0	8.2.4.0	—
oracle-communications-session-route-manager	8.0.0	8.2.4	—
oracle-graph-server-and-client	—	—	21.4
oracle-healthcare-translational-research	4.1.0	4.1.0	—
oracle-hospitality-cruise-shipboard-property-management-system	20.1.0	20.1.0	—
oracle-instantis-enterprisetrack	17.1	17.1	—
oracle-instantis-enterprisetrack	17.2	17.2	—
oracle-instantis-enterprisetrack	17.3	17.3	—
oracle-managed-file-transfer	12.2.1.3.0	12.2.1.3.0	—
oracle-managed-file-transfer	12.2.1.4.0	12.2.1.4.0	—
oracle-mysql-enterprise-monitor	—	8.0.25	—
oracle-sd-wan-edge	9.0	9.0	—
oracle-sd-wan-edge	9.1	9.1	—
oracle-secure-global-desktop	5.6	5.6	—
oracle-utilities-testing-accelerator	6.0.0.1.1	6.0.0.1.1	—
oracle-utilities-testing-accelerator	6.0.0.2.2	6.0.0.2.2	—
oracle-utilities-testing-accelerator	6.0.0.3.1	6.0.0.3.1	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları