CVE-2017-5651
Last modified
CVE-2017-5651 is a vulnerability of currently unknown severity. In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. EPSS estimates a 7.75% chance of exploitation in the next 30 days.
Description
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Tomcat | 8.5.0 | — |
| Apache | Tomcat | 8.5.1 | — |
| Apache | Tomcat | 8.5.2 | — |
| Apache | Tomcat | 8.5.3 | — |
| Apache | Tomcat | 8.5.4 | — |
| Apache | Tomcat | 8.5.5 | — |
| Apache | Tomcat | 8.5.6 | — |
| Apache | Tomcat | 8.5.7 | — |
| Apache | Tomcat | 8.5.8 | — |
| Apache | Tomcat | 8.5.9 | — |
| Apache | Tomcat | 8.5.10 | — |
| Apache | Tomcat | 8.5.11 | — |
| Apache | Tomcat | 8.5.12 | — |
| Apache | Tomcat | 9.0.0 | Milestone1 |
References
- http://www.securityfocus.com/bid/97544Third Party Advisory, VDB Entry
- https://bz.apache.org/bugzilla/show_bug.cgi?id=60918Issue Tracking, Patch
- http://www.securityfocus.com/bid/97544Third Party Advisory, VDB Entry
- https://bz.apache.org/bugzilla/show_bug.cgi?id=60918Issue Tracking, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-5651?
How severe is CVE-2017-5651?
How do I fix CVE-2017-5651?
Are you affected by CVE-2017-5651?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST