CVE-2021-33037 (Medium) detected in tomcat-embed-core-8.5.28.jar
Opened this issue · 0 comments
CVE-2021-33037 - Medium Severity Vulnerability
Vulnerable Library - tomcat-embed-core-8.5.28.jar
Core Tomcat implementation
Library home page: http://tomcat.apache.org/
Path to dependency file: /myretail/build.gradle
Path to vulnerable library: /build.gradle
Dependency Hierarchy:
- spring-boot-starter-web-2.0.0.RELEASE.jar (Root Library)
- spring-boot-starter-tomcat-2.0.0.RELEASE.jar
- ❌ tomcat-embed-core-8.5.28.jar (Vulnerable Library)
- spring-boot-starter-tomcat-2.0.0.RELEASE.jar
Found in base branch: master
Vulnerability Details
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
Publish Date: 2021-07-12
URL: CVE-2021-33037
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2021-07-12
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 8.5.68
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.0.RELEASE
Step up your Open Source Security Game with Mend here