CVE:CVE-2019-17569
CNNVD:CNNVD-202002-1126
Apache Tomcat是美国阿帕奇（Apache）软件基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat 9.0.28版本至9.0.30版本、8.5.48版本至8.5.50版本和7.0.98版本至7.0.99版本中存在安全漏洞，该漏洞源于程序没有正确处理无效的Transfer-Encoding标头。攻击者可利用该漏洞造成Web缓存中毒，绕过Web应用程序防火墙保护及实施跨站脚本攻击。
solution:Upgrade apache tomcat to a higher version than 7.0.99,8.5.50,9.0.30,and avoid the version [7.0.98,7.0.99],[8.5.48,8.5.50],[9.0.28,9.0.30]; Upgrade apache tomee to a higher version than 7.0.7,and avoid the version 7.0.7; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1; Upgrade netapp data_availability_services to a higher version than -; Upgrade netapp oncommand_system_manager to a higher version than 3.1.3,and avoid the version [3.0.0,3.1.3]; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade oracle agile_engineering_data_management to a higher version than 6.2.1.0,and avoid the version 6.2.1.0; Upgrade oracle agile_plm to a higher version than 9.3.3,9.3.5,9.3.6,and avoid the version 9.3.3,9.3.5,9.3.6; Upgrade oracle communications_instant_messaging_server to a higher version than 10.0.1.4.0,and avoid the version 10.0.1.4.0; Upgrade oracle health_sciences_empirica_inspections to a higher version than 1.0.1.2,and avoid the version 1.0.1.2; Upgrade oracle health_sciences_empirica_signal to a higher version than 7.3.3,and avoid the version 7.3.3; Upgrade oracle hospitality_guest_access to a higher version than 4.2.0,4.2.1,and avoid the version 4.2.0,4.2.1; Upgrade oracle instantis_enterprisetrack to a higher version than 17.3,and avoid the version [17.1,17.3]; Upgrade oracle mysql_enterprise_monitor to a higher version than 4.0.12,8.0.20,and avoid the version (,4.0.12],[8.0.0,8.0.20]; Upgrade oracle transportation_management to a higher version than 6.3.7,and avoid the version 6.3.7; Upgrade oracle workload_manager to a higher version than 12.2.0.1,18c,19c,and avoid the version 12.2.0.1,18c,19c