Re: Hostheader attack vulnerability

There isn't anything here that indicates there there is a problem for Tomcat to solve. You appear to be using a tool provided by Cisco. I suggest you contact Cisco for support. If you still believe that there is a Tomcat issue here please provide: - Full details (including HTTP headers) of a

[10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

Hi, After upgrading from 9.0.59 to 10.1.4, I've started getting these kind of errors: java.lang.IllegalArgumentException: The HTTP header line [if-none-match:"e76590d5""] does not conform to RFC 7230 and has been ignored. at org.apache.coyote.http11.Http11InputBuffer.skipLine(Http11Input

Re: [10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

Hard to tell from the data posted. What we really need to see are the bytes on the wire for a failed request. Can you capture that with wireshark (or similar) and post what you find? Mark On 15/12/2022 16:17, Martynas Jusevičius wrote: Hi, After upgrading from 9.0.59 to 10.1.4, I've start

Re: [10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

Hi Mark, I've captured something using https://github.com/nicolaka/netshoot#tcpdump (attached as a .pcap file), but I'm not sure it's correct and/or what you need. If you gave me some instructions, that would be easier. My app is running in a Docker container, the request comes from a script on W

Re: [10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

Hi Martynas, The list strips (nearly all) attachments. Please send it to me directly and I'll let you know if it is what we need. Mark On 15/12/2022 19:51, Martynas Jusevičius wrote: Hi Mark, I've captured something using https://github.com/nicolaka/netshoot#tcpdump (attached as a .pcap fi

Re: [10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

Thanks, I have the pcap file. It looks to be the right network connection as it shows the start of a connection to port 8080. However, it only contains the first packet. I need at least all the packets up to the point the HTTP request is sent and ideally all the packets from the connection.

Re: [10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

OK, I think I got them. GET /default-subject is the request with the If-None-Match header. On Thu, Dec 15, 2022 at 9:11 PM Mark Thomas wrote: > > Thanks, I have the pcap file. > > It looks to be the right network connection as it shows the start of a > connection to port 8080. > > However, it on

Re: [10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

Sounds good. Could you send it directly to me again please. Thanks. Mark On 15/12/2022 20:15, Martynas Jusevičius wrote: OK, I think I got them. GET /default-subject is the request with the If-None-Match header. On Thu, Dec 15, 2022 at 9:11 PM Mark Thomas wrote: Thanks, I have the pcap f

Re: [10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

Got it thanks. I can see what the problem is now. The line ending for the If-None-Match header is CR. It should be CRLF. RFC 7230 does allow servers to accept just LF (Tomcat does) but a bare CR is not acceptable. It Tomcat sees a CR followed by anything other than a LF that will trigger a 40

Re: [10.1.4] If-None-Match does not conform to RFC 7230 and has been ignored

Thanks. The error was on my end -- the header value included a trailing newline. On Thu, Dec 15, 2022 at 10:59 PM Mark Thomas wrote: > > Got it thanks. > > I can see what the problem is now. > > The line ending for the If-None-Match header is CR. It should be CRLF. > > RFC 7230 does allow servers

HTTP/2 streams reset by Tomcat are treted as 503 errors by Apache HTTP Server

Hello. We are having a random issue in a setup with Tomcat deployed behind Apache httpd. Some HTTP/2 requests proxied to Tomcat by httpd end with a 503 (service unavailable) response to the web browser client. Tomcat version is 9.0.58 running with Java 1.8.0 in a Docker container. Docker vers