5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.005 Low
EPSS
Percentile
75.0%
Issue Overview:
Incorrect documentation of CGI Servlet search algorithm may lead to misconfiguration
As part of the fix for bug 61201, the documentation for Apache Tomcat included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected. (CVE-2017-15706)
Affected Packages:
tomcat8
Issue Correction:
Run yum update tomcat8 to update your system.
New Packages:
noarch:
tomcat8-jsp-2.3-api-8.5.28-1.76.amzn1.noarch
tomcat8-webapps-8.5.28-1.76.amzn1.noarch
tomcat8-el-3.0-api-8.5.28-1.76.amzn1.noarch
tomcat8-docs-webapp-8.5.28-1.76.amzn1.noarch
tomcat8-servlet-3.1-api-8.5.28-1.76.amzn1.noarch
tomcat8-javadoc-8.5.28-1.76.amzn1.noarch
tomcat8-8.5.28-1.76.amzn1.noarch
tomcat8-lib-8.5.28-1.76.amzn1.noarch
tomcat8-admin-webapps-8.5.28-1.76.amzn1.noarch
tomcat8-log4j-8.5.28-1.76.amzn1.noarch
src:
tomcat8-8.5.28-1.76.amzn1.src
Red Hat: CVE-2017-15706
Mitre: CVE-2017-15706
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.005 Low
EPSS
Percentile
75.0%