CVE-2017-5651: Expected Behavior Violation in Apache Tomcat
Summary
CVE-2017-5651: Expected Behavior Violation in Apache Tomcat. Affects org.apache.tomcat:tomcat-coyote across 2 version ranges.
>= 8.5.0, < 8.5.13
>= 9.0.0.M1, < 9.0.0.M19
Fixed in 8.5.13 or 9.0.0.M19, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to execute Java servlets and render web pages that include Java Server Page coding. It provides a Java HTTP web server environment for running Java code. The vulnerability identified as CVE-2017-5651 affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12. This vulnerability is related to the refactoring of the HTTP connectors, which introduced a regression in the send file processing. As a result, the same Processor could be used for multiple requests, leading to unexpected errors and response mix-up.
Vulnerability Detail
The vulnerability in Apache Tomcat arises from a regression in the send file processing introduced during the refactoring of the HTTP connectors. When the send file processing completed quickly, the Processor could be added to the processor cache twice. This could result in the same Processor being used for multiple requests, leading to unexpected errors and response mix-up. The impact of this vulnerability can be severe, potentially causing data corruption, unauthorized access, or denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.138.5.13 -
>= 9.0.0.M1, < 9.0.0.M199.0.0.M19
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the send file feature in the Apache Tomcat configuration. This can be achieved by setting the 'enableSendfile' attribute to 'false' in the Connector configuration. However, it is recommended to apply the official fix by upgrading to the latest version as soon as possible.
Conclusion
The vulnerability in Apache Tomcat (CVE-2017-5651) can have severe consequences, including data corruption, unauthorized access, or denial of service. It is crucial to upgrade to the latest version of Apache Tomcat to mitigate the risk. If immediate upgrading is not possible, a temporary workaround is available by disabling the send file feature. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat-coyote →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a Java HTTP web server environment for running Java code.
The vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12.
The vulnerability can lead to unexpected errors and response mix-up, potentially causing data corruption, unauthorized access, or denial of service.
To fix this vulnerability, it is recommended to upgrade to Apache Tomcat version 9.0.0.M19 or later for versions 9.x, and version 8.5.13 or later for versions 8.5.x.
Yes, a temporary workaround is to disable the send file feature in the Apache Tomcat configuration by setting the 'enableSendfile' attribute to 'false' in the Connector configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-coyote.
