CVE-2020-1935: 
Java vulnerability analysis and mitigation

CVE-2020-1935 affects Apache Tomcat versions 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99. The vulnerability was discovered in the HTTP header parsing code which used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid (NVD).

The vulnerability has a CVSS v3.1 Base Score of 4.8 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. The issue stems from incorrect validation of HTTP header parsing, which could lead to HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner (NVD).

This vulnerability could lead to HTTP Request Smuggling attacks in specific configurations where Tomcat is behind a reverse proxy. However, such a reverse proxy configuration that would make this exploitable is considered unlikely (Rapid7).

The vulnerability has been fixed in Apache Tomcat versions 7.0.100, 8.5.51, and 9.0.31. Users should upgrade to these or later versions to address the vulnerability. Various Linux distributions have also released security updates including Ubuntu (Ubuntu Notice), Debian (Debian Notice), and OpenSUSE (OpenSUSE Notice).