Bug#1057082: tomcat10: CVE-2023-46589

[Salvatore Bonaccorso]

Source: tomcat10
Version: 10.1.15-1
Severity: important
Tags: security upstream fixed-upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for tomcat10.

CVE-2023-46589[0]:
| Improper Input Validation vulnerability in Apache Tomcat.Tomcat from
| 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from
| 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not
| correctly parse HTTP trailer headers. A trailer header that exceeded
| the header size limit could cause Tomcat to treat a single  request
| as multiple requests leading to the possibility of request
| smuggling when behind a reverse proxy.  Users are recommended to
| upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83
| onwards or 8.5.96 onwards, which fix the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-46589
    https://www.cve.org/CVERecord?id=CVE-2023-46589
[1] https://www.openwall.com/lists/oss-security/2023/11/28/2
[2] https://github.com/apache/tomcat/commit/b5776d769bffeade865061bc8ecbeb2b56167b08

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore