Description

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

References

http://rhn.redhat.com/errata/RHSA-2017-0244.html

http://rhn.redhat.com/errata/RHSA-2017-0245.html

http://rhn.redhat.com/errata/RHSA-2017-0246.html

http://rhn.redhat.com/errata/RHSA-2017-0247.html

http://rhn.redhat.com/errata/RHSA-2017-0250.html

http://rhn.redhat.com/errata/RHSA-2017-0457.html

http://rhn.redhat.com/errata/RHSA-2017-0527.html

http://www.debian.org/security/2016/dsa-3738

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.securityfocus.com/bid/94461

http://www.securitytracker.com/id/1037332

https://access.redhat.com/errata/RHSA-2017:0455

https://access.redhat.com/errata/RHSA-2017:0456

https://access.redhat.com/errata/RHSA-2017:0935

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://security.netapp.com/advisory/ntap-20180607-0001/

https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48

https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73

https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39

https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8

https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13

https://usn.ubuntu.com/4557-1/

https://www.exploit-db.com/exploits/41783/

Details

Risk Information

CVSS v2

CVSS v3