vulnwire
9.8crit

CVE-2017-5651

Expected Behavior Violation in Apache Tomcat

Also known as GHSA-9hg2-395j-83rm

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
7.8%
percentile 95%
Public exploits
0
none known

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.

Exploit prediction (EPSS)

7.75% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat-coyote
>=9.0.0.M1, <9.0.0.M19
>=8.5.0, <8.5.13
9.0.0.M19
8.5.13
mavenorg.apache.tomcat.embed:tomcat-embed-core
>=9.0.0.M1, <9.0.0.M19
>=8.5.0, <8.5.13
9.0.0.M19
8.5.13

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-440 Expected Behavior Violation

References

  • securityfocus.com /bid/97544 · vdb-entry, x_refsource_BID, x_transferred
  • security.gentoo.org /glsa/201705-09 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • security.netapp.com /advisory/ntap-20180614-0001/ · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/6694538826b87522fb723d2dcedd537e14ebe0a381d92e5525a531d8%40%3Cannounce.tomcat · mailing-list, x_refsource_MLIST, x_transferred
  • securitytracker.com /id/1038219 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2017-3236622.html · x_refsource_CONFIRM, x_transferred
  • bz.apache.org /bugzilla/show_bug.cgi?id=60918 · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-5651 · advisory
  • github.com /apache/tomcat/commit/494429ca210641b6b7affe89a2b0a6c0ff70109b · web
  • github.com /apache/tomcat/commit/9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 · web
  • web.archive.org /web/20170420113605/http://www.securitytracker.com/id/1038219 · web
  • web.archive.org /web/20170417124228/http://www.securityfocus.com/bid/97544 · web
  • security.netapp.com /advisory/ntap-20180614-0001 · web
  • lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/6694538826b87522fb723d2dcedd537e14ebe0a381d92e5525a531d8@%3Cannounce.tomcat.a · web
  • lists.apache.org /thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache · web
  • github.com /search?q=repo%3Aapache%2Ftomcat+apache.coyote+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=cod · web
  • github.com /apache/tomcat · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.