Description
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43, 7.0.0 to 7.0.77 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | tomcat8 | 8.5.14-1+deb9u1 | DSA-3891-1 |
| Debian 8 | tomcat7 | 7.0.56-3+deb8u11 | DSA-3892-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u10 | DSA-3891-1 |
| Debian 7 | tomcat7 | 7.0.28-4+deb7u14 | DLA-996-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.5 | USN-3519-1 |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.13 | USN-3519-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | tomcat7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | tomcat6 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | tomcat +9 | 7.0.69-12.el7_3 | RHSA-2017:1809 |
| RHEL 6 | tomcat6 +8 | 6.0.24-111.el6_9 | RHSA-2017:3080 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | log4j-eap6 | 1.2.16-12.redhat_3.1.ep6.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-10.redhat_10.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-22.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-24.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 2 | jbcs-httpd24-openssl +4 | 1:1.0.2h-13.jbcs.el6 | RHSA-2017:2493 |
| Red Hat JBoss Web Server 2 | tomcat6 +10 | 6.0.41-17_patch_04.ep6.el6 | RHSA-2017:2493 |
| Red Hat JBoss Web Server 2 | tomcat7 +10 | 7.0.54-25_patch_05.ep6.el6 | RHSA-2017:2493 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-7.SP6_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | codehaus-jackson +4 | 1.9.9-11.redhat_5.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.27-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-22.SP20_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.22-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-as-ee +60 | 7.5.17-2.Final_redhat_4.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.17-1.Final_redhat_4.ep6.el6 | RHSA-2017:2638 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.10-3.SP3_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.2.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-vfs2 | 3.2.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.17-4.Final_redhat_4.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.5.17-1.Final_redhat_4.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.24-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | log4j-eap6 | 1.2.16-12.redhat_3.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | log4j-jboss-logmanager | 1.1.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | picketlink-bindings +1 | 2.5.4-17.SP15_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | tomcat | 8.0.43-29.5.1 | SUSE-SU-2017:3039-1 |
| SLES 12 SP2 | tomcat | 8.0.43-29.5.1 | SUSE-SU-2017:3039-1 |
| SLES 12 SP1 | tomcat | 8.0.43-10.24.1 | SUSE-SU-2017:3279-1 |
| SLES 12 | tomcat | 7.0.82-7.16.1 | SUSE-SU-2017:3059-1 |
| SLES 11 SP4 | tomcat6 | 6.0.53-0.57.7.1 | SUSE-SU-2018:1847-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | tomcat | 8.0.43-29.5.1 | SUSE-SU-2017:3039-1 |
| SLES for SAP 12 SP2 | tomcat | 8.0.43-29.5.1 | SUSE-SU-2017:3039-1 |
| SLES for SAP 12 SP1 | tomcat | 8.0.43-10.24.1 | SUSE-SU-2017:3279-1 |
| SLES for SAP 11 SP4 | tomcat6 | 6.0.53-0.57.7.1 | SUSE-SU-2018:1847-1 |
| SUSE OpenStack Cloud 6 | tomcat | 8.0.43-10.24.1 | SUSE-SU-2017:3279-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 9.0.36-8.4 | openSUSE-SU-2024:11468-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | tomcat +9 | 7.0.69-12.el7_3 | ELSA-2017-1809 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 9.0.0.M1, < 9.0.0.M21 | 9.0.0.M21 | GHSA-jmvv-524f-hj5j |
| Maven | org.apache.tomcat:tomcat | >= 8.5.0, < 8.5.15 | 8.5.15 | GHSA-jmvv-524f-hj5j |
| Maven | org.apache.tomcat:tomcat | >= 8.0.0, < 8.0.44 | 8.0.44 | GHSA-jmvv-524f-hj5j |
| Maven | org.apache.tomcat:tomcat | >= 7.0.0, < 7.0.78 | 7.0.78 | GHSA-jmvv-524f-hj5j |
Advisories 21
- RHSA-2017:2493 Red Hat Security Advisory: Red Hat JBoss Web Server 2 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:1801 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:2638 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:3080 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2636 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2635 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:1809 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-3519-1 tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-996-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3892-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3891-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:3039-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:3059-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:3279-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1847-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1212 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2025
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- ELSA-2017-1809 Important: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 27, 2017
References
- DSA-3891 vendor-advisory
- https://security.netapp.com/advisory/ntap-20171019-0002/
- 98888 vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- RHSA-2017:3080 vendor-advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us
- RHSA-2017:1801 vendor-advisory
- RHSA-2017:2635 vendor-advisory
- RHSA-2017:2638 vendor-advisory
- RHSA-2017:2494 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- [tomcat-users] 20170606 [SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass mailing-list
- RHSA-2017:2636 vendor-advisory
- RHSA-2017:1809 vendor-advisory
- RHSA-2017:2637 vendor-advisory
- 1038641 vdb-entry
- DSA-3892 vendor-advisory
- RHSA-2017:2633 vendor-advisory
- RHSA-2017:1802 vendor-advisory
- RHSA-2017:2493 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list