CVE-2017-7674: Medium severity Apache Tomcat vulnerability
The CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
Affected versions: 7.0.41 to 7.0.78, 8.0.0.RC1 to 8.0.44, 8.5.0 to 8.5.15
Upstream patches:
Tomcat 7: https://svn.apache.org/viewvc?view=revision&revision=1795816 Tomcat 8.0.x: https://svn.apache.org/viewvc?view=revision&revision=1795815 Tomcat 8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1795814
External References:
https://tomcat.apache.org/security-7.html https://tomcat.apache.org/security-8.html
Other sources
The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 7.0.79 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.0.45 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.5.16 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 9.0.0.M22 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.79 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.45 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.16 - Upgrade
Upgrade
Apache Tomcat (CORS Filter)to a version that resolves this vulnerability.Fixed in 8.5.16 - Upgrade
Upgrade
Apache Tomcat (CORS Filter)to a version that resolves this vulnerability.Fixed in 8.0.45 - Upgrade
Upgrade
Apache Tomcat (CORS Filter)to a version that resolves this vulnerability.Fixed in 7.0.79 - Compensating control
Mitigate cache poisoning risk by ensuring caches (client/proxy/server) vary cached responses based on the Origin header for responses produced by the Apache Tomcat CORS Filter until the fixed Tomcat version is deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7674?
CVE-2017-7674 has a severity rating that may vary, but it is generally considered to allow for potential cache poisoning which can compromise security.
How do I fix CVE-2017-7674?
To fix CVE-2017-7674, upgrade to Apache Tomcat version 7.0.79, 8.0.45, 8.5.16, or 9.0.0.M22.
Which Apache Tomcat versions are affected by CVE-2017-7674?
CVE-2017-7674 affects Apache Tomcat versions 7.0.41 to 7.0.78, 8.0.0.RC1 to 8.0.44, 8.5.0 to 8.5.15, as well as 9.0.0.M1 to 9.0.0.M21.
What challenges are presented by CVE-2017-7674?
CVE-2017-7674 can lead to client and server cache poisoning, potentially allowing an attacker to manipulate cached responses.
Is CVE-2017-7674 a common vulnerability?
CVE-2017-7674 is notable in the context of Apache Tomcat and reflects broader concerns regarding Cross-Origin Resource Sharing (CORS) policies.