Most recent entries from all

bdu:2022-07501

BIT-tomcat-2022-42252 — Apache Tomcat request smuggling via malformed content-length

Affected: Bitnami: tomcat

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0 to 9.0.67, 10.0.0 to 10.0.26 or 10.1.0 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

certfr-2022-avi-975 — Une vulnérabilité a été découverte dans Apache Tomcat. Elle permet à un attaquant de provoquer un contournement de la p…

certfr-2022-avi-975

Withdrawn: CLEANSTART-2026-AG86451 — Security fixes in tomcat9 9.0.68-r0

Withdrawn by the publisher.

Affected: CleanStart: tomcat9

Package tomcat9 version 9.0.68-r0 fixes 1 vulnerabilities: CVE-2022-42252

EUVD-2026-237886

fkie_cve-2022-42252

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

GHSA-p22x-g9px-3945 — Apache Tomcat may reject request containing invalid Content-Length header

Affected: Maven: org.apache.tomcat.embed:tomcat-embed-core, Maven: org.apache.tomcat:tomcat-coyote

gsd-2022-42252

OESA-2023-1058 — tomcat security update

Affected: openEuler:20.03-LTS-SP1: tomcat, openEuler:20.03-LTS-SP3: tomcat, openEuler:22.03-LTS: tomcat, openEuler:22.03-LTS-SP1: tomcat

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project Security Fix(es): If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.(CVE-2022-42252)

openSUSE-SU-2024:12534-1 — tomcat-9.0.43-11.1 on GA media

tomcat-9.0.43-11.1 on GA media

RHSA-2023:1663 — Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.2 release and security update

tomcat: request smuggling tomcat: JsonErrorReportValve injection

SUSE-SU-2022:4193-1 — Security update for tomcat

Security update for tomcat

UBUNTU-CVE-2022-42252

Affected: Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9

WID-SEC-W-2022-1918 — Apache Tomcat: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um Sicherheitsvorkehrungen zu umgehen.