CVE-2017-5647: Infoleak
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
Other sources
A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
Affected versions: 6.0.0 to 6.0.52, 7.0.0 to 7.0.76, 8.0.0.RC1 to 8.0.42, 8.5.0 to 8.5.12
Upstream fixes:
Tomcat 6.x: https://svn.apache.org/viewvc?view=revision&revision=1789024 https://svn.apache.org/viewvc?view=revision&revision=1789155 https://svn.apache.org/viewvc?view=revision&revision=1789856
Tomcat 7.x:
https://svn.apache.org/viewvc?view=revision&revision=1789008
Tomcat 8.0.x:
https://svn.apache.org/viewvc?view=revision&revision=1788999
Tomcat 8.5.x:
https://svn.apache.org/viewvc?view=revision&revision=1788932
References:
https://tomcat.apache.org/security-6.html#FixedinApacheTomcat6.0.53 https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.77 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.43 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.13
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 6.0.53 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.77 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.43 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.13 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.0.43 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 6.0.53 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 7.0.77 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.5.13 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 9.0.0.M19 - Upgrade
Upgrade
Apache Tomcat 6.xto a version that resolves this vulnerability.Fixed in 6.0.53 - Upgrade
Upgrade
Apache Tomcat 7.xto a version that resolves this vulnerability.Fixed in 7.0.77 - Upgrade
Upgrade
Apache Tomcat 8.0.xto a version that resolves this vulnerability.Fixed in 8.0.43 - Upgrade
Upgrade
Apache Tomcat 8.5.xto a version that resolves this vulnerability.Fixed in 8.5.13
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5647?
CVE-2017-5647 is rated as a moderate severity vulnerability based on its impact on the affected versions of Apache Tomcat.
How do I fix CVE-2017-5647?
To resolve CVE-2017-5647, users should upgrade to Apache Tomcat versions 6.0.53, 7.0.77, 8.0.43, or 8.5.13 or later.
What versions of Apache Tomcat are affected by CVE-2017-5647?
CVE-2017-5647 affects Apache Tomcat versions 6.0.0 to 6.0.52, 7.0.0 to 7.0.76, 8.0.0 to 8.0.42, and 9.0.0.M1 to 9.0.0.M18.
What kind of attack can exploit CVE-2017-5647?
CVE-2017-5647 can be exploited through pipelined requests where send file is utilized, resulting in requests being lost.
Is CVE-2017-5647 a remote code execution vulnerability?
CVE-2017-5647 is not a remote code execution vulnerability; it primarily affects the handling of pipelined requests.