CVE-2019-17569: apache tomcat +15 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2019-17569

CVSS 4.8 · Medium EPSS 8,9%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada apache tomcat, apache tomee +14 lainnya. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Rincian

Terbit di NVD: 24 Februari 2020
Terakhir diubah: 25 Agustus 2026
Status NVD: Modified
CVSS 3.1: 4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
EPSS (30 hari): 8,9% peluang dieksploitasi; lebih tinggi dari 95,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	tomcat	Versi 7.0.98 hingga 7.0.99
apache	tomcat	Versi 8.5.48 hingga 8.5.50
apache	tomcat	Versi 9.0.28 hingga 9.0.30
apache	tomee	Versi 7.0.7
opensuse	leap	Versi 15.1
netapp	data availability services	Semua versi
netapp	oncommand system manager	Versi 3.0.0 hingga 3.1.3
debian	debian linux	Versi 9.0
debian	debian linux	Versi 10.0
oracle	agile engineering data management	Versi 6.2.1.0
oracle	agile product lifecycle management	Versi 9.3.3
oracle	agile product lifecycle management	Versi 9.3.5
oracle	agile product lifecycle management	Versi 9.3.6
oracle	communications instant messaging server	Versi 10.0.1.4.0
oracle	health sciences empirica inspections	Versi 1.0.1.2
oracle	health sciences empirica signal	Versi 7.3.3
oracle	hospitality guest access	Versi 4.2.0
oracle	hospitality guest access	Versi 4.2.1
oracle	instantis enterprisetrack	Versi 17.1 hingga 17.3
oracle	mysql enterprise monitor	Semua versi hingga 4.0.12
oracle	mysql enterprise monitor	Versi 8.0.0 hingga 8.0.20
oracle	transportation management	Versi 6.3.7
oracle	workload manager	Versi 12.2.0.1
oracle	workload manager	Versi 18c
oracle	workload manager	Versi 19c

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.t... mailing list · advisory vendor
https://www.oracle.com/security-alerts/cpujan2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujul2020.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuoct2020.html patch · advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html mailing list · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20200327-0005/ advisory pihak ketiga
https://www.debian.org/security/2020/dsa-4673 advisory pihak ketiga
https://www.debian.org/security/2020/dsa-4680 advisory pihak ketiga
https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.to...
https://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743%40%3Ccommits.to...

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.