Vulnerability - Apache Tomcat (CVE-2021-33037) - What version of Tomcat is coming in 21.2.2?

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

"Plugin Output: 
  Path              : /spectrum/tomcat/bin/
  Installed version : 9.0.43
  Fixed version     : 9.0.48" "The version of Tomcat installed on the remote host is prior to 9.0.48. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.48_security-9 advisory.

  - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP     transfer-encoding request header in some circumstances leading to the possibility to request smuggling     when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if     the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding;
    and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
    (CVE-2021-33037)

 

Environment

Release : 21.2.x

 

Resolution

Tomcat version 9.0.50+ will be coming with Netops Spectrum 21.2.2.