Debian LTS: DLA-2133-1 Critical: Tomcat7 HTTP Request Smuggling Risks

The refactoring in 7.0.98 introduced a regression. The result of
the regression was that invalid Transfer-Encoding headers were
incorrectly processed leading to a possibility of HTTP Request
Smuggling if Tomcat was located behind a reverse proxy that
incorrectly handled the invalid Transfer-Encoding header in a
particular manner. Such a reverse proxy is considered unlikely.

CVE-2020-1935

The HTTP header parsing code used an approach to end-of-line (EOL)
parsing that allowed some invalid HTTP headers to be parsed as
valid. This led to a possibility of HTTP Request Smuggling if Tomcat
was located behind a reverse proxy that incorrectly handled the
invalid Transfer-Encoding header in a particular manner. Such a
reverse proxy is considered unlikely.

CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when
trusting incoming connections to Apache Tomcat. Tomcat treats AJP