CVE-2017-5648: Critical severity Apache Tomcat vulnerability
While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
Affected versions: 7.0.0 to 7.0.75, 8.0.0.RC1 to 8.0.41, 8.5.0 to 8.5.11
Upstream fixes:
Tomcat 7.x:
https://svn.apache.org/viewvc?view=revision&revision=1785777
Tomcat 8.0.x:
https://svn.apache.org/viewvc?view=revision&revision=1785776
Tomcat 8.5.x:
https://svn.apache.org/viewvc?view=revision&revision=1785775
References:
https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.76 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.42 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.12
Other sources
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.76 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.42 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.12 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 7.0.76 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.0.42 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.5.13 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 9.0.0.M18 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 7.0.76 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 8.0.42 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 8.5.13 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 9.0.0.M18 - Upgrade
Upgrade
Apache Tomcat 7to a version that resolves this vulnerability.Fixed in 7.0.76 - Upgrade
Upgrade
Apache Tomcat 8.0to a version that resolves this vulnerability.Fixed in 8.0.42 - Upgrade
Upgrade
Apache Tomcat 8.5to a version that resolves this vulnerability.Fixed in 8.5.12
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5648?
CVE-2017-5648 has a CVSS base score of 5.4, indicating a medium severity vulnerability.
How do I fix CVE-2017-5648?
To fix CVE-2017-5648, upgrade to Apache Tomcat versions 7.0.76, 8.0.42, 8.5.12, or 9.0.0.M18 or later.
What versions of Apache Tomcat are affected by CVE-2017-5648?
CVE-2017-5648 affects Apache Tomcat versions 7.0.0 to 7.0.75, 8.0.0 to 8.0.41, 8.5.0 to 8.5.11, and 9.0.0.M1 to 9.0.0.M17.
What is the nature of the vulnerability in CVE-2017-5648?
The vulnerability in CVE-2017-5648 arises from improper handling of certain calls to application listeners under a SecurityManager.
Is CVE-2017-5648 a local or remote vulnerability?
CVE-2017-5648 can be exploited locally when running untrusted applications under a SecurityManager.