CVE-2017-5651: Critical severity Apache Tomcat vulnerability
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.5.13 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 9.0.0.M19 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-coyoteto a version that resolves this vulnerability.Fixed in 8.5.13 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-coyoteto a version that resolves this vulnerability.Fixed in 9.0.0.M19
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5651?
CVE-2017-5651 has a medium severity rating due to the potential for processor cache corruption in Apache Tomcat.
How do I fix CVE-2017-5651?
To fix CVE-2017-5651, upgrade to Apache Tomcat versions 8.5.13 or 9.0.0.M19.
Which versions of Apache Tomcat are affected by CVE-2017-5651?
CVE-2017-5651 affects Apache Tomcat versions 8.5.0 to 8.5.12 and 9.0.0.M1 to 9.0.0.M18.
Can CVE-2017-5651 affect file processing in Tomcat?
Yes, CVE-2017-5651 can cause issues in file processing due to the potential for duplicated processors in the cache.
What components are related to CVE-2017-5651 in Apache Tomcat?
CVE-2017-5651 is associated with the Tomcat HTTP connectors and specifically the send file processing feature.