CVE-2017-5650: Improper Resource Shutdown or Release in Apache Tomcat
Summary
CVE-2017-5650: Improper Resource Shutdown or Release in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 8.5.0, < 8.5.13
>= 9.0.0.M1, < 9.0.0.M19
Fixed in 8.5.13 or 9.0.0.M19, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java web applications. It provides a Java HTTP web server environment for running Java code. This vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12. The vulnerability arises from the improper handling of an HTTP/2 GOAWAY frame for a connection, which fails to close streams associated with that connection that are waiting for a WINDOW_UPDATE. This can lead to the consumption of all available processing threads by a malicious client.
Vulnerability Detail
The vulnerability in Apache Tomcat allows a malicious client to construct a series of HTTP/2 requests that can consume all available processing threads. This occurs because the handling of an HTTP/2 GOAWAY frame for a connection does not close streams associated with the connection that are waiting for a WINDOW_UPDATE. As a result, each waiting stream consumes a thread, allowing a malicious client to exhaust the available processing threads. This can lead to a denial-of-service (DoS) condition, impacting the availability of the Apache Tomcat server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.138.5.13 -
>= 9.0.0.M1, < 9.0.0.M199.0.0.M19
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of Apache Tomcat as mentioned above.
Conclusion
In conclusion, the vulnerability in Apache Tomcat allows a malicious client to consume all available processing threads by constructing a series of HTTP/2 requests. This can lead to a denial-of-service (DoS) condition, impacting the availability of the Apache Tomcat server. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Apache Tomcat as mentioned above. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java web applications.
This vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12.
A malicious client can construct a series of HTTP/2 requests that consume all available processing threads, leading to a denial-of-service (DoS) condition and impacting the availability of the Apache Tomcat server.
To fix this vulnerability, it is recommended to upgrade to Apache Tomcat version 9.0.0.M19 or later for versions 9.x, and version 8.5.13 or later for versions 8.5.x.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of Apache Tomcat.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
