CVE-2017-5647 — Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Description

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tomcat	9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, 6.0.0 to 6.0.52	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 8	tomcat7	7.0.56-3+deb8u10	DSA-3842-1
Debian 8	tomcat8	8.0.14-1+deb8u9	DSA-3843-1
Debian 7	tomcat7	7.0.28-4+deb7u12	DLA-924-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	tomcat8	8.0.32-1ubuntu1.5	USN-3519-1
Ubuntu 14.04 LTS	tomcat7	7.0.52-1ubuntu0.13	USN-3519-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	tomcat7	No fix yet	—
Ubuntu Pro 14.04 LTS	tomcat6	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	tomcat +9	7.0.76-3.el7_4	RHSA-2017:3081
RHEL 6	tomcat6 +8	6.0.24-111.el6_9	RHSA-2017:3080

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 3	log4j-eap6	1.2.16-12.redhat_3.1.ep6.el6	RHSA-2017:1801
Red Hat JBoss Web Server 3	tomcat-native	1.2.8-10.redhat_10.ep7.el6	RHSA-2017:1801
Red Hat JBoss Web Server 3	tomcat7 +11	7.0.70-22.ep7.el6	RHSA-2017:1801
Red Hat JBoss Web Server 3	tomcat8 +11	8.0.36-24.ep7.el6	RHSA-2017:1801
Red Hat JBoss Web Server 2	jbcs-httpd24-openssl +4	1:1.0.2h-13.jbcs.el6	RHSA-2017:2493
Red Hat JBoss Web Server 2	tomcat6 +10	6.0.41-17_patch_04.ep6.el6	RHSA-2017:2493
Red Hat JBoss Web Server 2	tomcat7 +10	7.0.54-25_patch_05.ep6.el6	RHSA-2017:2493

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12 SP2	tomcat	8.0.43-23.1	SUSE-SU-2017:1229-1
SLES 12 SP1	tomcat	8.0.43-10.19.1	SUSE-SU-2017:1382-1
SLES 12	tomcat	7.0.78-7.13.4	SUSE-SU-2017:1660-1
SLES 11 SP4	tomcat6	6.0.53-0.56.1	SUSE-SU-2017:1632-1
SLES 11 SP3	tomcat6	6.0.53-0.56.1	SUSE-SU-2017:1632-1

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP2	tomcat	8.0.43-23.1	SUSE-SU-2017:1229-1
SLES for SAP 12 SP1	tomcat	8.0.43-10.19.1	SUSE-SU-2017:1382-1
SLES for SAP 12	tomcat	7.0.78-7.13.4	SUSE-SU-2017:1660-1
SLES for SAP 11 SP4	tomcat6	6.0.53-0.56.1	SUSE-SU-2017:1632-1
SUSE Linux Enterprise Point of Sale 11 SP3	tomcat6	6.0.53-0.56.1	SUSE-SU-2017:1632-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	tomcat	9.0.36-8.4	openSUSE-SU-2024:11468-1
openSUSE Tumbleweed	tomcat10	10.1.14-1.1	openSUSE-SU-2024:13441-1

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	tomcat +9	7.0.76-3.el7_4	ELSA-2017-3081

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat	>= 9.0.0.M1, < 9.0.0.M19	9.0.0.M19	GHSA-3gv7-3h64-78cm
Maven	org.apache.tomcat:tomcat	>= 8.5.0, < 8.5.13	8.5.13	GHSA-3gv7-3h64-78cm
Maven	org.apache.tomcat:tomcat	>= 8.0.0, < 8.0.43	8.0.43	GHSA-3gv7-3h64-78cm
Maven	org.apache.tomcat:tomcat	>= 7.0.0, < 7.0.77	7.0.77	GHSA-3gv7-3h64-78cm
Maven	org.apache.tomcat:tomcat	>= 6.0.0, < 6.0.53	6.0.53	GHSA-3gv7-3h64-78cm

Advisories 16

RHSA-2017:2493 Red Hat Security Advisory: Red Hat JBoss Web Server 2 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2017:1801 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2017:3081 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2017:3080 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-3519-1 tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DLA-924-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DSA-3843-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DSA-3842-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2017:1229-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:1632-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:1382-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:1660-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
ELSA-2017-3081 Important: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 30, 2017

References

GLSA-201705-09 vendor-advisory
https://security.netapp.com/advisory/ntap-20180614-0001/
RHSA-2017:3080 vendor-advisory
RHSA-2017:1801 vendor-advisory
DSA-3843 vendor-advisory
http://www.arubanetworks.com/assets/alert/HPESBHF03730.txt
RHSA-2017:2494 vendor-advisory
[users] 20170410 [SECURITY] CVE-2017-5647 Apache Tomcat Information Disclosure mailing-list
1038218 vdb-entry
DSA-3842 vendor-advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03730en_us
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
RHSA-2017:1802 vendor-advisory
RHSA-2017:2493 vendor-advisory
RHSA-2017:3081 vendor-advisory
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list