Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-46589

Good to know:

icon
icon

Date: November 28, 2023

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

Language: Java

Severity Score

Related Resources (17)

https://www.openwall.com/lists/oss-security/2023/11/28/2
https://github.com/apache/tomcat/commit/6f181e1062a472bc5f0234980f66cbde42c1041b
https://tomcat.apache.org/security-8.html
https://github.com/apache/tomcat/commit/7a2d8818fcea0b51747a67af9510ce7977245ebd
https://tomcat.apache.org/security-10.html
https://github.com/apache/tomcat/commit/b5776d769bffeade865061bc8ecbeb2b56167b08
https://lists.debian.org/debian-lts-announce/2024/01/msg00001.html
https://tomcat.apache.org/security-11.html
https://github.com/apache/tomcat
https://security.netapp.com/advisory/ntap-20231214-0009
https://nvd.nist.gov/vuln/detail/CVE-2023-46589
https://tomcat.apache.org/security-9.html
https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr
https://github.com/apache/tomcat/commit/aa92971e879a519384c517febc39fd04c48d4642
http://www.openwall.com/lists/oss-security/2023/11/28/2
https://security.netapp.com/advisory/ntap-20231214-0009/
https://www.mend.io/vulnerability-database/CVE-2023-46589

Severity Score

Weakness Type (CWE)

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-444

Improper Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version org.optaweb.vehiclerouting:optaweb-vehicle-routing-backend:no_fix;org.optaweb.vehiclerouting:optaweb-vehicle-routing-backend:no_fix;org.optaweb.vehiclerouting:optaweb-vehicle-routing-backend:no_fix;org.optaweb.vehiclerouting:optaweb-vehicle-routing-backend:no_fix;org.optaweb.vehiclerouting:optaweb-vehicle-routing-backend:no_fix;org.optaweb.vehiclerouting:optaweb-vehicle-routing-backend:no_fix;org.apache.tomcat.embed:tomcat-embed-core:11.0.0-M11;org.apache.tomcat.embed:tomcat-embed-core:8.5.96;org.apache.tomcat.embed:tomcat-embed-core:10.1.16;org.apache.tomcat.embed:tomcat-embed-core:9.0.83;org.apache.tomcat.embed:tomcat-embed-core:10.1.16;org.optaweb.employeerostering:optaweb-employee-rostering-standalone:no_fix;org.optaweb.employeerostering:optaweb-employee-rostering-standalone:no_fix;org.optaweb.employeerostering:optaweb-employee-rostering-standalone:no_fix;org.optaweb.employeerostering:optaweb-employee-rostering-standalone:no_fix;org.apache.tomcat:tomcat-coyote:8.5.96;org.apache.tomcat:tomcat-coyote:10.1.16;org.apache.tomcat:tomcat-coyote:11.0.0-M11;org.apache.tomcat:tomcat-coyote:9.0.83;io.fabric8.quickstarts.cxf.jaxrs:spring-boot-cxf-jaxrs-xml:no_fix;org.apache.tomcat:tomcat-catalina:9.0.83;org.apache.tomcat:tomcat-catalina:8.5.96;org.apache.tomcat:tomcat-catalina:11.0.0-M11;org.apache.tomcat:tomcat-catalina:10.1.16;org.kie:kie-server-spring-boot-integ-tests-sample:7.68.0.Final;org.jboss.redhat-fuse.apicurio:fuse-apicurito-generator:no_fix;org.jboss.redhat-fuse.apicurio:fuse-apicurito-generator:no_fix;org.kie:keycloak-kie-server-spring-boot-sample:7.68.0.Final;org.kie:keycloak-kie-server-spring-boot-sample:7.60.0.Final;org.kie:jbpm-spring-boot-sample-basic:7.68.0.Final;org.kie:jbpm-spring-boot-sample-basic:7.60.0.Final;org.kie:kie-server-spring-boot-kafka-sample:7.60.0.Final;org.kie:kie-server-spring-boot-kafka-sample:7.68.0.Final;org.optaweb.employeerostering:optaweb-employee-rostering-backend:no_fix;org.optaweb.employeerostering:optaweb-employee-rostering-backend:no_fix;org.optaweb.employeerostering:optaweb-employee-rostering-backend:no_fix;org.optaweb.employeerostering:optaweb-employee-rostering-backend:no_fix;org.optaweb.employeerostering:optaweb-employee-rostering-backend:no_fix;org.kie.kogito.examples:dmn-drools-springboot-metrics:1.6.0.Final;org.optaweb.employeerostering:employee-rostering-backend:no_fix;io.fabric8.quickstarts:spring-boot-camel-soap-rest-bridge:no_fix;org.kie.kogito.examples:ruleunit-springboot-example:1.6.0.Final;io.fabric8.quickstarts.cxf.jaxrs:spring-boot-cxf-jaxrs:no_fix;io.fabric8.quickstarts.cxf.jaxrs:spring-boot-cxf-jaxrs:no_fix;org.kie.kogito:dmn-listener-springboot:1.6.0.Final;org.kie.kogito:dmn-pmml-springboot-example:1.6.0.Final;org.kie.kogito:dmn-springboot-example:1.6.0.Final;org.acme:optaplanner-spring-boot-school-timetabling-quickstart:no_fix;org.kie.kogito:pmml-springboot-example:1.6.0.Final;org.kie:kie-server-spring-boot-sample:7.68.0.Final

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us