Debian LTS: DLA-2733-1 Moderate: Tomcat8 HTTP Smuggling and Auth Issues

debian lts

August 5, 2021

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine

Topics Covered

security advisory debian authentication issue tomcat http smuggling

Summary

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to
authenticate using variations of a valid user name and/or to bypass some of
the protection provided by the LockOut Realm.

CVE-2021-33037

Apache Tomcat did not correctly parse the HTTP transfer-encoding request
header in some circumstances leading to the possibility to request
smuggling when used with a reverse proxy. Specifically: - Tomcat
incorrectly ignored the transfer encoding header if the client declared it
would only accept an HTTP/1.0 response; - Tomcat honoured the identify
encoding; and - Tomcat did not ensure that, if present, the chunked
encoding was the final encoding.

For Debian 9 stretch, these problems have been fixed in version
8.5.54-0+deb9u7.

We recommend that you upgrade your tomcat8 packages.

For the detailed security status of tomcat8 please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply