Lucene search

[email protected]NVD:CVE-2017-5647

HistoryApr 17, 2017 - 4:59 p.m.

CVE-2017-5647

2017-04-1716:59:00

CWE-200

[email protected]

web.nvd.nist.gov

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.8%

JSON

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

Affected configurations

NVD

Node

apachetomcatMatch6.0.0

apachetomcatMatch6.0.1

apachetomcatMatch6.0.2

apachetomcatMatch6.0.3

apachetomcatMatch6.0.4

apachetomcatMatch6.0.5

apachetomcatMatch6.0.6

apachetomcatMatch6.0.7

apachetomcatMatch6.0.8

apachetomcatMatch6.0.9

apachetomcatMatch6.0.10

apachetomcatMatch6.0.11

apachetomcatMatch6.0.12

apachetomcatMatch6.0.13

apachetomcatMatch6.0.14

apachetomcatMatch6.0.15

apachetomcatMatch6.0.16

apachetomcatMatch6.0.17

apachetomcatMatch6.0.18

apachetomcatMatch6.0.19

apachetomcatMatch6.0.20

apachetomcatMatch6.0.21

apachetomcatMatch6.0.22

apachetomcatMatch6.0.23

apachetomcatMatch6.0.24

apachetomcatMatch6.0.25

apachetomcatMatch6.0.26

apachetomcatMatch6.0.27

apachetomcatMatch6.0.28

apachetomcatMatch6.0.29

apachetomcatMatch6.0.30

apachetomcatMatch6.0.31

apachetomcatMatch6.0.32

apachetomcatMatch6.0.33

apachetomcatMatch6.0.34

apachetomcatMatch6.0.35

apachetomcatMatch6.0.36

apachetomcatMatch6.0.37

apachetomcatMatch6.0.38

apachetomcatMatch6.0.39

apachetomcatMatch6.0.40

apachetomcatMatch6.0.41

apachetomcatMatch6.0.42

apachetomcatMatch6.0.43

apachetomcatMatch6.0.44

apachetomcatMatch6.0.45

apachetomcatMatch6.0.46

apachetomcatMatch6.0.47

apachetomcatMatch6.0.48

apachetomcatMatch6.0.49

apachetomcatMatch6.0.50

apachetomcatMatch6.0.51

apachetomcatMatch6.0.52

Node

apachetomcatMatch7.0.0

apachetomcatMatch7.0.1

apachetomcatMatch7.0.2

apachetomcatMatch7.0.3

apachetomcatMatch7.0.4

apachetomcatMatch7.0.5

apachetomcatMatch7.0.6

apachetomcatMatch7.0.7

apachetomcatMatch7.0.8

apachetomcatMatch7.0.9

apachetomcatMatch7.0.10

apachetomcatMatch7.0.11

apachetomcatMatch7.0.12

apachetomcatMatch7.0.13

apachetomcatMatch7.0.14

apachetomcatMatch7.0.15

apachetomcatMatch7.0.16

apachetomcatMatch7.0.17

apachetomcatMatch7.0.18

apachetomcatMatch7.0.19

apachetomcatMatch7.0.20

apachetomcatMatch7.0.21

apachetomcatMatch7.0.22

apachetomcatMatch7.0.23

apachetomcatMatch7.0.24

apachetomcatMatch7.0.25

apachetomcatMatch7.0.26

apachetomcatMatch7.0.27

apachetomcatMatch7.0.28

apachetomcatMatch7.0.29

apachetomcatMatch7.0.30

apachetomcatMatch7.0.31

apachetomcatMatch7.0.32

apachetomcatMatch7.0.33

apachetomcatMatch7.0.34

apachetomcatMatch7.0.35

apachetomcatMatch7.0.36

apachetomcatMatch7.0.37

apachetomcatMatch7.0.38

apachetomcatMatch7.0.39

apachetomcatMatch7.0.40

apachetomcatMatch7.0.41

apachetomcatMatch7.0.42

apachetomcatMatch7.0.43

apachetomcatMatch7.0.44

apachetomcatMatch7.0.45

apachetomcatMatch7.0.46

apachetomcatMatch7.0.47

apachetomcatMatch7.0.48

apachetomcatMatch7.0.49

apachetomcatMatch7.0.50

apachetomcatMatch7.0.51

apachetomcatMatch7.0.52

apachetomcatMatch7.0.53

apachetomcatMatch7.0.54

apachetomcatMatch7.0.55

apachetomcatMatch7.0.56

apachetomcatMatch7.0.57

apachetomcatMatch7.0.58

apachetomcatMatch7.0.59

apachetomcatMatch7.0.60

apachetomcatMatch7.0.61

apachetomcatMatch7.0.62

apachetomcatMatch7.0.63

apachetomcatMatch7.0.64

apachetomcatMatch7.0.65

apachetomcatMatch7.0.66

apachetomcatMatch7.0.67

apachetomcatMatch7.0.68

apachetomcatMatch7.0.69

apachetomcatMatch7.0.70

apachetomcatMatch7.0.71

apachetomcatMatch7.0.72

apachetomcatMatch7.0.73

apachetomcatMatch7.0.74

apachetomcatMatch7.0.75

apachetomcatMatch7.0.76

Node

apachetomcatMatch8.0.0

apachetomcatMatch8.0.0rc1

apachetomcatMatch8.0.1

apachetomcatMatch8.0.2

apachetomcatMatch8.0.3

apachetomcatMatch8.0.4

apachetomcatMatch8.0.5

apachetomcatMatch8.0.6

apachetomcatMatch8.0.7

apachetomcatMatch8.0.8

apachetomcatMatch8.0.9

apachetomcatMatch8.0.10

apachetomcatMatch8.0.11

apachetomcatMatch8.0.12

apachetomcatMatch8.0.13

apachetomcatMatch8.0.14

apachetomcatMatch8.0.15

apachetomcatMatch8.0.16

apachetomcatMatch8.0.17

apachetomcatMatch8.0.18

apachetomcatMatch8.0.19

apachetomcatMatch8.0.20

apachetomcatMatch8.0.21

apachetomcatMatch8.0.22

apachetomcatMatch8.0.23

apachetomcatMatch8.0.24

apachetomcatMatch8.0.25

apachetomcatMatch8.0.26

apachetomcatMatch8.0.27

apachetomcatMatch8.0.28

apachetomcatMatch8.0.29

apachetomcatMatch8.0.30

apachetomcatMatch8.0.31

apachetomcatMatch8.0.32

apachetomcatMatch8.0.33

apachetomcatMatch8.0.34

apachetomcatMatch8.0.35

apachetomcatMatch8.0.36

apachetomcatMatch8.0.37

apachetomcatMatch8.0.38

apachetomcatMatch8.0.39

apachetomcatMatch8.0.40

apachetomcatMatch8.0.41

apachetomcatMatch8.0.42

Node

apachetomcatMatch8.5.0

apachetomcatMatch8.5.1

apachetomcatMatch8.5.2

apachetomcatMatch8.5.3

apachetomcatMatch8.5.4

apachetomcatMatch8.5.5

apachetomcatMatch8.5.6

apachetomcatMatch8.5.7

apachetomcatMatch8.5.8

apachetomcatMatch8.5.9

apachetomcatMatch8.5.10

apachetomcatMatch8.5.11

apachetomcatMatch8.5.12

Node

apachetomcatMatch9.0.0milestone1

apachetomcatMatch9.0.0milestone10

apachetomcatMatch9.0.0milestone11

apachetomcatMatch9.0.0milestone12

apachetomcatMatch9.0.0milestone13

apachetomcatMatch9.0.0milestone14

apachetomcatMatch9.0.0milestone15

apachetomcatMatch9.0.0milestone16

apachetomcatMatch9.0.0milestone17

apachetomcatMatch9.0.0milestone18

apachetomcatMatch9.0.0milestone2

apachetomcatMatch9.0.0milestone3

apachetomcatMatch9.0.0milestone4

apachetomcatMatch9.0.0milestone5

apachetomcatMatch9.0.0milestone6

apachetomcatMatch9.0.0milestone7

apachetomcatMatch9.0.0milestone8

apachetomcatMatch9.0.0milestone9

References

www.arubanetworks.com/assets/alert/HPESBHF03730.txt

www.debian.org/security/2017/dsa-3842

www.debian.org/security/2017/dsa-3843

www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

www.securitytracker.com/id/1038218

access.redhat.com/errata/RHSA-2017:1801

access.redhat.com/errata/RHSA-2017:1802

access.redhat.com/errata/RHSA-2017:2493

access.redhat.com/errata/RHSA-2017:2494

access.redhat.com/errata/RHSA-2017:3080

access.redhat.com/errata/RHSA-2017:3081

h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03730en_us

lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/5796678c5a773c6f3ff57c178ac247d85ceca0dee9190ba48171451a%40%3Cusers.tomcat.apache.org%3E

lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

security.gentoo.org/glsa/201705-09

security.netapp.com/advisory/ntap-20180614-0001/

www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.8%

JSON

Related for NVD:CVE-2017-5647

ubuntucve1 tomcat5 cve1 debian6 cvelist1 ibm21 openvas22 amazon2 debiancve1 veracode1 prion1 github1 nessus34 redhatcve1 osv5 f51 mageia1 suse5 oraclelinux4 ubuntu1 redhat6 centos2 fedora3 atlassian4 symantec1 gentoo1 oracle2