You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@tomee.apache.org by "Jayaprakash (Jira)" <ji...@apache.org> on 2020/03/20 09:44:00 UTC

[jira] [Created] (TOMEE-2790) TomEE plus(7.0.7) is affected by CVE-2020-1935 & CVE-2019-17569 vulnerabilities

Jayaprakash created TOMEE-2790:
----------------------------------

             Summary: TomEE plus(7.0.7) is affected by CVE-2020-1935 & CVE-2019-17569 vulnerabilities
                 Key: TOMEE-2790
                 URL: https://issues.apache.org/jira/browse/TOMEE-2790
             Project: TomEE
          Issue Type: Bug
    Affects Versions: 7.0.7
            Reporter: Jayaprakash


TomEE plus (7.0.7) is using Apache Tomcat 8.5.50 version which is affected by below vulnerabilities, 
 * CVE-2020-1935 (BDSA-2020-0328) : Apache Tomcat Vulnerable to HTTP Request Smuggling via 'parseHeader' EOL Parsing
 * CVE-2019-17569 (BDSA-2020-0330) : Apache Tomcat Vulnerable to HTTP Request Smuggling via Regression in 'parseTokenList'
Apache Tomcat(8.5.51) addresses this vulnerability. 

Can you please upgrade TomEE plus(7.0.7) with Apache Tomcat(8.5.51) version or later which addresses these vulnerabilities.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)