CVE-2022-42252

A flaw was found in Apache Tomcat. If the server is configured to ignore invalid HTTP headers, the server does not reject a request containing an invalid content-length header, making it vulnerable to a request smuggling attack.

Red Hat Satellite does not include the affected Apache Tomcat, however, Tomcat is shipped with Red Hat Enterprise Linux and consumed by the Candlepin component of Satellite. Red Hat Satellite users are therefore advised to check the impact state of Red Hat Enterprise Linux, since any necessary fixes will be distributed through the platform.

Tomcat requires a non-standard setting of rejectIllegalHeader = false. Also it demands Tomcat to be behind a proxy reverse proxy that also failed to reject the request with the invalid header. A malicious attacker would need time and efforts to go through the environment and jeopardize the environment by accessing protected data. Hence the CVSS score of 4.8.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.