PT-2017-2367 · Apache · Apache Tomcat

Published 2017-03-30 · Updated 2023-12-08 · CVE-2017-5651

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.12 Apache Tomcat versions 9.0.0.M1 through 9.0.0.M18

Description The refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up. The issue is related to the incorrect handling of data, which could allow a remote attacker to obtain confidential information.

Recommendations For Apache Tomcat versions 8.5.0 through 8.5.12, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 9.0.0.M1 through 9.0.0.M18, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the send file processing feature until a patch is available. Restrict access to the affected HTTP connectors to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-440

CWE-19

Related Identifiers

BDU:2017-01567

CVE-2017-5651

GHSA-9HG2-395J-83RM

Affected Products

Apache Tomcat

References · 39

• https://security.gentoo.org/glsa/201705-09 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01567 · Security Note
• https://bz.apache.org/bugzilla/show_bug.cgi?id=60918 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-5651 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5651 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9hg2-395j-83rm · Vendor Advisory
• https://github.com/apache/tomcat · Note
• https://github.com/apache/tomcat/commit/494429ca210641b6b7affe89a2b0a6c0ff70109b · Note
• https://github.com/apache/tomcat/commit/9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 · Note
• https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E · Note
• http://securityfocus.com/bid/97544 · Note
• https://tomcat.apache.org/security-8 · Note
• https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E · Note