Strix
26.1K

CVE-2021-33037

MEDIUMCVSS 5.3/10EPSS 75.35%

Last modified

CVE-2021-33037 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.. EPSS estimates a 75.35% chance of exploitation in the next 30 days.

Description

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Probability
75.35%

99.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ApacheTomcat>= 8.5.0, <= 8.5.66
ApacheTomcat> 9.0.0, <= 9.0.46
ApacheTomcat> 10.0.0, <= 10.0.6
ApacheTomee8.0.6
DebianDebian Linux9.0
DebianDebian Linux10.0
OracleAgile Plm9.3.6
OracleCommunications Cloud Native Core Policy1.14.0
OracleCommunications Cloud Native Core Service Communication Proxy1.14.0
OracleCommunications Diameter Signaling Router>= 8.0.0.0, <= 8.5.0.2
OracleCommunications Instant Messaging Server10.0.1.5.0
OracleCommunications Policy Management12.5.0
OracleCommunications Pricing Design Center12.0.0.3.0
OracleCommunications Session Report Manager>= 8.0.0, <= 8.2.4.0
OracleCommunications Session Route Manager>= 8.0.0, <= 8.2.4
OracleGraph Server And Client< 21.4
OracleHealthcare Translational Research4.1.0
OracleHospitality Cruise Shipboard Property Management System20.1.0
OracleInstantis Enterprisetrack17.1
OracleInstantis Enterprisetrack17.2
OracleInstantis Enterprisetrack17.3
OracleManaged File Transfer12.2.1.3.0
OracleManaged File Transfer12.2.1.4.0
OracleMysql Enterprise Monitor<= 8.0.25
OracleSd-Wan Edge9.0
OracleSd-Wan Edge9.1
OracleSecure Global Desktop5.6
OracleUtilities Testing Accelerator6.0.0.1.1
OracleUtilities Testing Accelerator6.0.0.2.2
OracleUtilities Testing Accelerator6.0.0.3.1
McafeeEpolicy Orchestrator< 5.10.0
McafeeEpolicy Orchestrator5.10.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-33037?
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
How severe is CVE-2021-33037?
CVE-2021-33037 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 75.35% probability of exploitation in the next 30 days.
How do I fix CVE-2021-33037?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-33037?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST