{"action":"Upgrade org.apache.tomcat:tomcat to 7.0.100 (7.x), 8.5.51 (8.x) or 9.0.31 (9.x) or later.","affected":[{"fixed":"7.0.100","introduced":"7.0.98"},{"fixed":"8.5.51","introduced":"8.5.48"},{"fixed":"9.0.31","introduced":"9.0.28"}],"component":"org.apache.tomcat:tomcat","cve_ids":["CVE-2019-17569"],"ecosystem":"Maven","epss":0.08872,"exploited":false,"fixed_versions":["7.0.100","8.5.51","9.0.31"],"ghsa_id":"GHSA-767j-jfh2-jvrc","id":"tcs_01M5N8HKDC1AHAWCKDQ2CRK59X","modified_at":"2024-02-21T05:31:17.449525Z","published_at":"2020-02-28T01:10:58Z","references":["https://osv.dev/vulnerability/GHSA-767j-jfh2-jvrc","https://nvd.nist.gov/vuln/detail/CVE-2019-17569","https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78@%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743@%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html","https://security.netapp.com/advisory/ntap-20200327-0005","https://www.debian.org/security/2020/dsa-4673","https://www.debian.org/security/2020/dsa-4680","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-767j-jfh2-jvrc#Maven/org.apache.tomcat:tomcat","url":"https://osv.dev/vulnerability/GHSA-767j-jfh2-jvrc"}],"summary":"Potential HTTP request smuggling in Apache Tomcat"}