[TOMEE-4256] Port fix for CVE-2023-45648

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 9.1.0
• Fix Version/s: 9.1.1
• Assignee: Richard Zowalla
• Reporter: Richard Zowalla
• Created: 11/Oct/23 07:10
• Updated: 12/Oct/23 09:27
• Resolved: 12/Oct/23 09:27

Description

Important: Request smuggling CVE-2023-45648

Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

This was fixed with commit 8ecff306.

This issue was reported to the Tomcat Security Team on 12 September 2023. The issue was made public on 10 October 2023.

Affects: 10.1.0-M1 to 10.1.13