tomcat: Incorrect handling of pipelined requests when send file was used

🗓️ 25 Jul 2017 17:46:13Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

Tomcat mishandles pipelined requests with Sendfile, risking duplicate processor cache and exposure on Unix.

Reporter	Title	Published	Views	Family All 186
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Apache Tomcat affect IBM Rational License Key Server Administration and Reporting Tool	17 Jun 201805:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat affects the IBM FlashSystem models 840 and 900	18 Feb 202301:45	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Build Forge Security Advisory (CVE-2016-8610, CVE-2017-6056, CVE-2017-5647, CVE-2017-5648)	17 Jun 201805:21	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in Apache Tomcat affect multiple IBM Rational products based on IBM's Jazz technology	28 Apr 202118:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities	16 Jun 202221:33	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Reporting for Development Intelligence	17 Jun 201805:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects SAN Volume Controller, Storwize family and FlashSystem V9000 products (CVE-2017-5647)	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat Vulnerabilities Affect IBM Sterling B2B Integrator	29 Apr 202502:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is vulnerable to using Components with Known Vulnerabilities	16 Jun 201822:05	–	ibm
IBM Security Bulletins	Security Bulletin: An Authenticated Agent Can Modify Another Agent's Properties (CVE-2018-1995)	3 Apr 201919:55	–	ibm

Vulners

Node

redhat jboss_enterprise_web_serverRange<3.1

AND

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2017-5647
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-5647
cve	www.cve.org/CVERecord

28 May 2026 20:35Current

7.3High risk

Vulners AI Score7.3

CVSS 25

CVSS 37.5

EPSS0.1684

tomcat pipelined requests sendfile processor cache information disclosure unix