csaf_suse - suse-su-2017:3039-1

Vulnerability from csaf_suse

Published

2017-11-22 08:33

Modified

2017-11-22 08:33

Summary

Security update for tomcat

Notes

Title of the patch

Security update for tomcat

Description of the patch

This update for tomcat fixes the following issues: Security issues fixed: - CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. (bsc#1042910). - CVE-2017-7674: A CORS Filter issue could lead to client and server side cache poisoning (bsc#1053352) - CVE-2017-12617: A remote code execution possibility via JSP Upload was fixed (bsc#1059554) Non security bugs fixed: - Fix tomcat-digest classpath error (bsc#977410) - Fix packaged /etc/alternatives symlinks for api libs that caused rpm -V to report link mismatch (bsc#1019016)

Patchnames

SUSE-SLE-RPI-12-SP2-2017-1874,SUSE-SLE-SERVER-12-SP2-2017-1874,SUSE-SLE-SERVER-12-SP3-2017-1874

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for tomcat",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for tomcat fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. (bsc#1042910).\n- CVE-2017-7674: A CORS Filter issue could lead to client and server side cache poisoning (bsc#1053352)\n- CVE-2017-12617: A remote code execution possibility via JSP Upload was fixed (bsc#1059554)\n\n\nNon security bugs fixed:\n\n- Fix tomcat-digest classpath error (bsc#977410) \n- Fix packaged /etc/alternatives symlinks for api libs that caused\n  rpm -V to report link mismatch (bsc#1019016)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-SLE-RPI-12-SP2-2017-1874,SUSE-SLE-SERVER-12-SP2-2017-1874,SUSE-SLE-SERVER-12-SP3-2017-1874",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_3039-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2017:3039-1",
            url: "https://www.suse.com/support/update/announcement/2017/suse-su-20173039-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2017:3039-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2017-November/003401.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1019016",
            url: "https://bugzilla.suse.com/1019016",
         },
         {
            category: "self",
            summary: "SUSE Bug 1042910",
            url: "https://bugzilla.suse.com/1042910",
         },
         {
            category: "self",
            summary: "SUSE Bug 1053352",
            url: "https://bugzilla.suse.com/1053352",
         },
         {
            category: "self",
            summary: "SUSE Bug 1059554",
            url: "https://bugzilla.suse.com/1059554",
         },
         {
            category: "self",
            summary: "SUSE Bug 977410",
            url: "https://bugzilla.suse.com/977410",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-12617 page",
            url: "https://www.suse.com/security/cve/CVE-2017-12617/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-5664 page",
            url: "https://www.suse.com/security/cve/CVE-2017-5664/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-7674 page",
            url: "https://www.suse.com/security/cve/CVE-2017-7674/",
         },
      ],
      title: "Security update for tomcat",
      tracking: {
         current_release_date: "2017-11-22T08:33:59Z",
         generator: {
            date: "2017-11-22T08:33:59Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2017:3039-1",
         initial_release_date: "2017-11-22T08:33:59Z",
         revision_history: [
            {
               date: "2017-11-22T08:33:59Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "tomcat-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-8.0.43-29.5.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "tomcat-javadoc-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-javadoc-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-javadoc-8.0.43-29.5.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "tomcat-lib-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-lib-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-lib-8.0.43-29.5.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "tomcat-webapps-8.0.43-29.5.1.noarch",
                        product: {
                           name: "tomcat-webapps-8.0.43-29.5.1.noarch",
                           product_id: "tomcat-webapps-8.0.43-29.5.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
                        product: {
                           name: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
                           product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles:12:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP2",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP2",
                           product_id: "SUSE Linux Enterprise Server 12 SP2",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles:12:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP3",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP3",
                           product_id: "SUSE Linux Enterprise Server 12 SP3",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles:12:sp3",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12:sp3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-admin-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-docs-webapp-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-javadoc-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-javadoc-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-lib-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-lib-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
               product_id: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-admin-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-docs-webapp-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-javadoc-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-javadoc-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-lib-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-lib-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP2",
               product_id: "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-admin-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-docs-webapp-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-javadoc-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-javadoc-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-lib-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-lib-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-admin-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-docs-webapp-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-javadoc-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-javadoc-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-lib-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-lib-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
               product_id: "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-admin-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-admin-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-docs-webapp-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-docs-webapp-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-javadoc-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-javadoc-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-lib-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-lib-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "tomcat-webapps-8.0.43-29.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
            },
            product_reference: "tomcat-webapps-8.0.43-29.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2017-12617",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-12617",
            },
         ],
         notes: [
            {
               category: "general",
               text: "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-12617",
               url: "https://www.suse.com/security/cve/CVE-2017-12617",
            },
            {
               category: "external",
               summary: "SUSE Bug 1059554 for CVE-2017-12617",
               url: "https://bugzilla.suse.com/1059554",
            },
            {
               category: "external",
               summary: "SUSE Bug 1062607 for CVE-2017-12617",
               url: "https://bugzilla.suse.com/1062607",
            },
            {
               category: "external",
               summary: "SUSE Bug 1180947 for CVE-2017-12617",
               url: "https://bugzilla.suse.com/1180947",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189861 for CVE-2017-12617",
               url: "https://bugzilla.suse.com/1189861",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-11-22T08:33:59Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-12617",
      },
      {
         cve: "CVE-2017-5664",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-5664",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-5664",
               url: "https://www.suse.com/security/cve/CVE-2017-5664",
            },
            {
               category: "external",
               summary: "SUSE Bug 1042910 for CVE-2017-5664",
               url: "https://bugzilla.suse.com/1042910",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-11-22T08:33:59Z",
               details: "important",
            },
         ],
         title: "CVE-2017-5664",
      },
      {
         cve: "CVE-2017-7674",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-7674",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-7674",
               url: "https://www.suse.com/security/cve/CVE-2017-7674",
            },
            {
               category: "external",
               summary: "SUSE Bug 1053352 for CVE-2017-7674",
               url: "https://bugzilla.suse.com/1053352",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tomcat-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.43-29.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.43-29.5.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-11-22T08:33:59Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-7674",
      },
   ],
}

cve-2017-5664

Vulnerability from cvelistv5

Published

2017-06-06 14:00

Modified

2024-08-05 15:11

Severity ?

Summary

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

References

▼	URL	Tags
	http://www.debian.org/security/2017/dsa-3891	vendor-advisory, x_refsource_DEBIAN
	https://security.netapp.com/advisory/ntap-20171019-0002/	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/98888	vdb-entry, x_refsource_BID
	http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:3080	vendor-advisory, x_refsource_REDHAT
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1801	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2635	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2638	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2494	vendor-advisory, x_refsource_REDHAT
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2017:2636	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1809	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2637	vendor-advisory, x_refsource_REDHAT
	http://www.securitytracker.com/id/1038641	vdb-entry, x_refsource_SECTRACK
	http://www.debian.org/security/2017/dsa-3892	vendor-advisory, x_refsource_DEBIAN
	https://access.redhat.com/errata/RHSA-2017:2633	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1802	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2493	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 9.0.0.M1 to 9.0.0.M20 Version: 8.5.0 to 8.5.14 Version: 8.0.0.RC1 to 8.0.43 Version: 7.0.0 to 7.0.77

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T15:11:48.039Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "DSA-3891",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2017/dsa-3891",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20171019-0002/",
               },
               {
                  name: "98888",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/98888",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "RHSA-2017:3080",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3080",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
               },
               {
                  name: "RHSA-2017:1801",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1801",
               },
               {
                  name: "RHSA-2017:2635",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2635",
               },
               {
                  name: "RHSA-2017:2638",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2638",
               },
               {
                  name: "RHSA-2017:2494",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2494",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  name: "[tomcat-users] 20170606 [SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E",
               },
               {
                  name: "RHSA-2017:2636",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2636",
               },
               {
                  name: "RHSA-2017:1809",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1809",
               },
               {
                  name: "RHSA-2017:2637",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2637",
               },
               {
                  name: "1038641",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1038641",
               },
               {
                  name: "DSA-3892",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2017/dsa-3892",
               },
               {
                  name: "RHSA-2017:2633",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2633",
               },
               {
                  name: "RHSA-2017:1802",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1802",
               },
               {
                  name: "RHSA-2017:2493",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2493",
               },
               {
                  name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
               },
               {
                  name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache Tomcat",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     status: "affected",
                     version: "9.0.0.M1 to 9.0.0.M20",
                  },
                  {
                     status: "affected",
                     version: "8.5.0 to 8.5.14",
                  },
                  {
                     status: "affected",
                     version: "8.0.0.RC1 to 8.0.43",
                  },
                  {
                     status: "affected",
                     version: "7.0.0 to 7.0.77",
                  },
               ],
            },
         ],
         datePublic: "2017-06-06T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Security Constrainy Bypass",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-02-13T16:09:07",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               name: "DSA-3891",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "http://www.debian.org/security/2017/dsa-3891",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20171019-0002/",
            },
            {
               name: "98888",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/98888",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "RHSA-2017:3080",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3080",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
            },
            {
               name: "RHSA-2017:1801",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1801",
            },
            {
               name: "RHSA-2017:2635",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2635",
            },
            {
               name: "RHSA-2017:2638",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2638",
            },
            {
               name: "RHSA-2017:2494",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2494",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               name: "[tomcat-users] 20170606 [SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E",
            },
            {
               name: "RHSA-2017:2636",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2636",
            },
            {
               name: "RHSA-2017:1809",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1809",
            },
            {
               name: "RHSA-2017:2637",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2637",
            },
            {
               name: "1038641",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1038641",
            },
            {
               name: "DSA-3892",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "http://www.debian.org/security/2017/dsa-3892",
            },
            {
               name: "RHSA-2017:2633",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2633",
            },
            {
               name: "RHSA-2017:1802",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1802",
            },
            {
               name: "RHSA-2017:2493",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2493",
            },
            {
               name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
            },
            {
               name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2017-5664",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache Tomcat",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "9.0.0.M1 to 9.0.0.M20",
                                       },
                                       {
                                          version_value: "8.5.0 to 8.5.14",
                                       },
                                       {
                                          version_value: "8.0.0.RC1 to 8.0.43",
                                       },
                                       {
                                          version_value: "7.0.0 to 7.0.77",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache Software Foundation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Security Constrainy Bypass",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "DSA-3891",
                     refsource: "DEBIAN",
                     url: "http://www.debian.org/security/2017/dsa-3891",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20171019-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20171019-0002/",
                  },
                  {
                     name: "98888",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/98888",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
                  },
                  {
                     name: "RHSA-2017:3080",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:3080",
                  },
                  {
                     name: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
                     refsource: "CONFIRM",
                     url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
                  },
                  {
                     name: "RHSA-2017:1801",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1801",
                  },
                  {
                     name: "RHSA-2017:2635",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2635",
                  },
                  {
                     name: "RHSA-2017:2638",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2638",
                  },
                  {
                     name: "RHSA-2017:2494",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2494",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
                  },
                  {
                     name: "[tomcat-users] 20170606 [SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066@%3Cannounce.tomcat.apache.org%3E",
                  },
                  {
                     name: "RHSA-2017:2636",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2636",
                  },
                  {
                     name: "RHSA-2017:1809",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1809",
                  },
                  {
                     name: "RHSA-2017:2637",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2637",
                  },
                  {
                     name: "1038641",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1038641",
                  },
                  {
                     name: "DSA-3892",
                     refsource: "DEBIAN",
                     url: "http://www.debian.org/security/2017/dsa-3892",
                  },
                  {
                     name: "RHSA-2017:2633",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2633",
                  },
                  {
                     name: "RHSA-2017:1802",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1802",
                  },
                  {
                     name: "RHSA-2017:2493",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2493",
                  },
                  {
                     name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
                  },
                  {
                     name: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
                  },
                  {
                     name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2017-5664",
      datePublished: "2017-06-06T14:00:00",
      dateReserved: "2017-01-29T00:00:00",
      dateUpdated: "2024-08-05T15:11:48.039Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-12617

Vulnerability from cvelistv5

Published

2017-10-03 15:00

Modified

2025-02-04 18:46

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2017:3113	vendor-advisory, x_refsource_REDHAT
	http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:3080	vendor-advisory, x_refsource_REDHAT
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:0269	vendor-advisory, x_refsource_REDHAT
	https://www.exploit-db.com/exploits/42966/	exploit, x_refsource_EXPLOIT-DB
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:0270	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:0271	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2018:2939	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:0465	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3665-1/	vendor-advisory, x_refsource_UBUNTU
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:0268	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:3114	vendor-advisory, x_refsource_REDHAT
	https://www.exploit-db.com/exploits/43008/	exploit, x_refsource_EXPLOIT-DB
	http://www.securitytracker.com/id/1039552	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/100954	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:0275	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:0466	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20171018-0002/	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20180117-0002/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:3081	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://support.f5.com/csp/article/K53173544	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 9.0.0.M1 to 9.0.0 Version: 8.5.0 to 8.5.22 Version: 8.0.0.RC1 to 8.0.46 Version: 7.0.0 to 7.0.81

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T18:43:56.415Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2017:3113",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3113",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "RHSA-2017:3080",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3080",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
               },
               {
                  name: "RHSA-2018:0269",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0269",
               },
               {
                  name: "42966",
                  tags: [
                     "exploit",
                     "x_refsource_EXPLOIT-DB",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/42966/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us",
               },
               {
                  name: "RHSA-2018:0270",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0270",
               },
               {
                  name: "RHSA-2018:0271",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0271",
               },
               {
                  name: "[debian-lts-announce] 20171107 [SECURITY] [DLA 1166-1] tomcat7 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html",
               },
               {
                  name: "RHSA-2018:2939",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2939",
               },
               {
                  name: "RHSA-2018:0465",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0465",
               },
               {
                  name: "USN-3665-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3665-1/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  name: "RHSA-2018:0268",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0268",
               },
               {
                  name: "RHSA-2017:3114",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3114",
               },
               {
                  name: "43008",
                  tags: [
                     "exploit",
                     "x_refsource_EXPLOIT-DB",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/43008/",
               },
               {
                  name: "1039552",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1039552",
               },
               {
                  name: "100954",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/100954",
               },
               {
                  name: "RHSA-2018:0275",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0275",
               },
               {
                  name: "RHSA-2018:0466",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0466",
               },
               {
                  name: "[announce] 20171003 [SECURITY] CVE-2017-12617 Apache Tomcat Remote Code Execution via JSP upload",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20171018-0002/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20180117-0002/",
               },
               {
                  name: "RHSA-2017:3081",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3081",
               },
               {
                  name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.f5.com/csp/article/K53173544",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
               },
               {
                  name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "HIGH",
                     attackVector: "NETWORK",
                     availabilityImpact: "HIGH",
                     baseScore: 8.1,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "HIGH",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2017-12617",
                        options: [
                           {
                              Exploitation: "active",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-04T18:46:14.471455Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
               {
                  other: {
                     content: {
                        dateAdded: "2022-03-25",
                        reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12617",
                     },
                     type: "kev",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-434",
                        description: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-04T18:46:52.662Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache Tomcat",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     status: "affected",
                     version: "9.0.0.M1 to 9.0.0",
                  },
                  {
                     status: "affected",
                     version: "8.5.0 to 8.5.22",
                  },
                  {
                     status: "affected",
                     version: "8.0.0.RC1 to 8.0.46",
                  },
                  {
                     status: "affected",
                     version: "7.0.0 to 7.0.81",
                  },
               ],
            },
         ],
         datePublic: "2017-10-03T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-02-13T16:09:13.000Z",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               name: "RHSA-2017:3113",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3113",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "RHSA-2017:3080",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3080",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
            },
            {
               name: "RHSA-2018:0269",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0269",
            },
            {
               name: "42966",
               tags: [
                  "exploit",
                  "x_refsource_EXPLOIT-DB",
               ],
               url: "https://www.exploit-db.com/exploits/42966/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us",
            },
            {
               name: "RHSA-2018:0270",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0270",
            },
            {
               name: "RHSA-2018:0271",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0271",
            },
            {
               name: "[debian-lts-announce] 20171107 [SECURITY] [DLA 1166-1] tomcat7 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html",
            },
            {
               name: "RHSA-2018:2939",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2939",
            },
            {
               name: "RHSA-2018:0465",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0465",
            },
            {
               name: "USN-3665-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3665-1/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               name: "RHSA-2018:0268",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0268",
            },
            {
               name: "RHSA-2017:3114",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3114",
            },
            {
               name: "43008",
               tags: [
                  "exploit",
                  "x_refsource_EXPLOIT-DB",
               ],
               url: "https://www.exploit-db.com/exploits/43008/",
            },
            {
               name: "1039552",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1039552",
            },
            {
               name: "100954",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/100954",
            },
            {
               name: "RHSA-2018:0275",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0275",
            },
            {
               name: "RHSA-2018:0466",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0466",
            },
            {
               name: "[announce] 20171003 [SECURITY] CVE-2017-12617 Apache Tomcat Remote Code Execution via JSP upload",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20171018-0002/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20180117-0002/",
            },
            {
               name: "RHSA-2017:3081",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3081",
            },
            {
               name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.f5.com/csp/article/K53173544",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            },
            {
               name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               DATE_PUBLIC: "2017-10-03T00:00:00",
               ID: "CVE-2017-12617",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache Tomcat",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "9.0.0.M1 to 9.0.0",
                                       },
                                       {
                                          version_value: "8.5.0 to 8.5.22",
                                       },
                                       {
                                          version_value: "8.0.0.RC1 to 8.0.46",
                                       },
                                       {
                                          version_value: "7.0.0 to 7.0.81",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache Software Foundation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Remote Code Execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "RHSA-2017:3113",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:3113",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
                  },
                  {
                     name: "RHSA-2017:3080",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:3080",
                  },
                  {
                     name: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
                     refsource: "CONFIRM",
                     url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
                  },
                  {
                     name: "RHSA-2018:0269",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0269",
                  },
                  {
                     name: "42966",
                     refsource: "EXPLOIT-DB",
                     url: "https://www.exploit-db.com/exploits/42966/",
                  },
                  {
                     name: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us",
                     refsource: "CONFIRM",
                     url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us",
                  },
                  {
                     name: "RHSA-2018:0270",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0270",
                  },
                  {
                     name: "RHSA-2018:0271",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0271",
                  },
                  {
                     name: "[debian-lts-announce] 20171107 [SECURITY] [DLA 1166-1] tomcat7 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html",
                  },
                  {
                     name: "RHSA-2018:2939",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2939",
                  },
                  {
                     name: "RHSA-2018:0465",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0465",
                  },
                  {
                     name: "USN-3665-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3665-1/",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
                  },
                  {
                     name: "RHSA-2018:0268",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0268",
                  },
                  {
                     name: "RHSA-2017:3114",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:3114",
                  },
                  {
                     name: "43008",
                     refsource: "EXPLOIT-DB",
                     url: "https://www.exploit-db.com/exploits/43008/",
                  },
                  {
                     name: "1039552",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1039552",
                  },
                  {
                     name: "100954",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/100954",
                  },
                  {
                     name: "RHSA-2018:0275",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0275",
                  },
                  {
                     name: "RHSA-2018:0466",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0466",
                  },
                  {
                     name: "[announce] 20171003 [SECURITY] CVE-2017-12617 Apache Tomcat Remote Code Execution via JSP upload",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20171018-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20171018-0002/",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20180117-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20180117-0002/",
                  },
                  {
                     name: "RHSA-2017:3081",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:3081",
                  },
                  {
                     name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "https://support.f5.com/csp/article/K53173544",
                     refsource: "CONFIRM",
                     url: "https://support.f5.com/csp/article/K53173544",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
                  },
                  {
                     name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2017-12617",
      datePublished: "2017-10-03T15:00:00.000Z",
      dateReserved: "2017-08-07T00:00:00.000Z",
      dateUpdated: "2025-02-04T18:46:52.662Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-7674

Vulnerability from cvelistv5

Published

2017-08-11 02:00

Modified

2024-09-17 03:47

Severity ?

Summary

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

References

▼	URL	Tags
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1801	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20180614-0003/	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/100280	vdb-entry, x_refsource_BID
	http://www.debian.org/security/2017/dsa-3974	vendor-advisory, x_refsource_DEBIAN
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2017:1802	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:3081	vendor-advisory, x_refsource_REDHAT
	https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 9.0.0.M1 to 9.0.0.M21 Version: 8.5.0 to 8.5.15 Version: 8.0.0.RC1 to 8.0.44 Version: 7.0.41 to 7.0.78

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T16:12:27.949Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
               },
               {
                  name: "RHSA-2017:1801",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1801",
               },
               {
                  name: "[announce] 20170810 [SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20180614-0003/",
               },
               {
                  name: "100280",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/100280",
               },
               {
                  name: "DSA-3974",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2017/dsa-3974",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  name: "[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html",
               },
               {
                  name: "RHSA-2017:1802",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1802",
               },
               {
                  name: "RHSA-2017:3081",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:3081",
               },
               {
                  name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache Tomcat",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     status: "affected",
                     version: "9.0.0.M1 to 9.0.0.M21",
                  },
                  {
                     status: "affected",
                     version: "8.5.0 to 8.5.15",
                  },
                  {
                     status: "affected",
                     version: "8.0.0.RC1 to 8.0.44",
                  },
                  {
                     status: "affected",
                     version: "7.0.41 to 7.0.78",
                  },
               ],
            },
         ],
         datePublic: "2017-08-10T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Cache Poisoning",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-02-13T16:09:34",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
            },
            {
               name: "RHSA-2017:1801",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1801",
            },
            {
               name: "[announce] 20170810 [SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20180614-0003/",
            },
            {
               name: "100280",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/100280",
            },
            {
               name: "DSA-3974",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "http://www.debian.org/security/2017/dsa-3974",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               name: "[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html",
            },
            {
               name: "RHSA-2017:1802",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1802",
            },
            {
               name: "RHSA-2017:3081",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:3081",
            },
            {
               name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               DATE_PUBLIC: "2017-08-10T00:00:00",
               ID: "CVE-2017-7674",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache Tomcat",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "9.0.0.M1 to 9.0.0.M21",
                                       },
                                       {
                                          version_value: "8.5.0 to 8.5.15",
                                       },
                                       {
                                          version_value: "8.0.0.RC1 to 8.0.44",
                                       },
                                       {
                                          version_value: "7.0.41 to 7.0.78",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache Software Foundation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Cache Poisoning",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
                     refsource: "CONFIRM",
                     url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us",
                  },
                  {
                     name: "RHSA-2017:1801",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1801",
                  },
                  {
                     name: "[announce] 20170810 [SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f@%3Cannounce.tomcat.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20180614-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20180614-0003/",
                  },
                  {
                     name: "100280",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/100280",
                  },
                  {
                     name: "DSA-3974",
                     refsource: "DEBIAN",
                     url: "http://www.debian.org/security/2017/dsa-3974",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
                  },
                  {
                     name: "[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html",
                  },
                  {
                     name: "RHSA-2017:1802",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1802",
                  },
                  {
                     name: "RHSA-2017:3081",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:3081",
                  },
                  {
                     name: "[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2017-7674",
      datePublished: "2017-08-11T02:00:00Z",
      dateReserved: "2017-04-11T00:00:00",
      dateUpdated: "2024-09-17T03:47:49.467Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

cve-2017-5664

Vulnerability from cvelistv5

cve-2017-12617

Vulnerability from cvelistv5

cve-2017-7674

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature