You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@tomee.apache.org by "Richard Zowalla (Jira)" <ji...@apache.org> on 2023/10/11 07:11:00 UTC

[jira] [Created] (TOMEE-4256) Port fix for CVE-2023-45648

Richard Zowalla created TOMEE-4256:
--------------------------------------

             Summary: Port fix for CVE-2023-45648
                 Key: TOMEE-4256
                 URL: https://issues.apache.org/jira/browse/TOMEE-4256
             Project: TomEE
          Issue Type: Dependency upgrade
    Affects Versions: 9.1.0
            Reporter: Richard Zowalla
            Assignee: Richard Zowalla
             Fix For: 9.1.1


Important: Request smuggling CVE-2023-45648

Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

This was fixed with commit 8ecff306.

This issue was reported to the Tomcat Security Team on 12 September 2023. The issue was made public on 10 October 2023.

Affects: 10.1.0-M1 to 10.1.13





--
This message was sent by Atlassian Jira
(v8.20.10#820010)