发布时间: 2023年11月3日
修改时间: 2023年11月3日
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
| NVD | openEuler | |
|---|---|---|
| CVSS评分 | 5.3 | 5.3 |
| Attack Vector | Network | Network |
| Attack Complexity | Low | Low |
| Privileges Required | None | None |
| User Interaction | None | None |
| Scope | Unchanged | Unchanged |
| Confidentiality | None | None |
| Integrity | Low | Low |
| Availability | None | None |
| 公告名 | 概要 | 发布时间 |
|---|---|---|
| KylinSec-SA-2023-1752 | tomcat security update | 2023年11月3日 |
| 产品 | 包 | 状态 |
|---|---|---|
| KY3.4-4A | tomcat | Fixed |
| KY3.4-5A | tomcat | Fixed |
| KY3.5.1 | tomcat | Fixed |
| KY3.5.2 | tomcat | Fixed |
