CVE-2017-5664: Improper Handling of Exceptional Conditions in Apache Tomcat
Summary
CVE-2017-5664: Improper Handling of Exceptional Conditions in Apache Tomcat. Affects org.apache.tomcat:tomcat across 4 version ranges.
>= 7.0.0, < 7.0.78
>= 8.0.0, < 8.0.44
>= 8.5.0, < 8.5.15
>= 9.0.0.M1, < 9.0.0.M21
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. Apache Tomcat versions 7.0.0 to 7.0.77, 8.0.0.RC1 to 8.0.43, 8.5.0 to 8.5.14, and 9.0.0.M1 to 9.0.0.M20 are affected by a vulnerability that can lead to unexpected and undesirable results for static error pages. This vulnerability, identified as CVE-2017-5664, can potentially allow an attacker to replace or remove custom error pages if the DefaultServlet is configured to permit writes.
Vulnerability Detail
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. However, the Default Servlet in Apache Tomcat versions 7.0.0 to 7.0.77, 8.0.0.RC1 to 8.0.43, 8.5.0 to 8.5.14, and 9.0.0.M1 to 9.0.0.M20 does not handle this properly. Depending on the original request, this can lead to unexpected and undesirable results for static error pages, including the replacement or removal of the custom error page. This vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.787.0.78 -
>= 8.0.0, < 8.0.448.0.44 -
>= 8.5.0, < 8.5.158.5.15 -
>= 9.0.0.M1, < 9.0.0.M219.0.0.M21
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable the DefaultServlet's write permissions. By preventing the DefaultServlet from writing to the custom error page, the risk of replacement or removal of the page can be mitigated. This can be achieved by modifying the configuration of the Apache Tomcat server to restrict the write permissions of the DefaultServlet.
Conclusion
In conclusion, the vulnerability CVE-2017-5664 in Apache Tomcat versions 7.0.0 to 7.0.77, 8.0.0.RC1 to 8.0.43, 8.5.0 to 8.5.14, and 9.0.0.M1 to 9.0.0.M20 can lead to unexpected and undesirable results for static error pages. It is crucial to upgrade to the latest version of Apache Tomcat to fix this vulnerability and ensure the proper handling of exceptional conditions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications.
Apache Tomcat versions 7.0.0 to 7.0.77, 8.0.0.RC1 to 8.0.43, 8.5.0 to 8.5.14, and 9.0.0.M1 to 9.0.0.M20 are affected by this vulnerability.
This vulnerability can lead to unexpected and undesirable results for static error pages, including the replacement or removal of custom error pages.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
To mitigate the risk, it is recommended to upgrade to Apache Tomcat version 7.0.78, 8.0.44, 8.5.15, or 9.0.0.M21 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
