CVE-2017-7674 — Insufficient Verification of Data Authenticity in Apache Tomcat

Description

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tomcat	9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44, 7.0.41 to 7.0.78	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 9	tomcat8	8.5.14-1+deb9u2	DSA-3974-1
Debian 8	tomcat7	7.0.56-3+really7.0.88-1	DLA-1400-1
Debian 8	tomcat8	8.0.14-1+deb8u11	DSA-3974-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	tomcat8	8.0.32-1ubuntu1.5	USN-3519-1
Ubuntu 14.04 LTS	tomcat7	7.0.52-1ubuntu0.13	USN-3519-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	tomcat7	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	tomcat +9	7.0.76-3.el7_4	RHSA-2017:3081

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 3	log4j-eap6	1.2.16-12.redhat_3.1.ep6.el6	RHSA-2017:1801
Red Hat JBoss Web Server 3	tomcat-native	1.2.8-10.redhat_10.ep7.el6	RHSA-2017:1801
Red Hat JBoss Web Server 3	tomcat7 +11	7.0.70-22.ep7.el6	RHSA-2017:1801
Red Hat JBoss Web Server 3	tomcat8 +11	8.0.36-24.ep7.el6	RHSA-2017:1801

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12 SP3	tomcat	8.0.43-29.5.1	SUSE-SU-2017:3039-1
SLES 12 SP2	tomcat	8.0.43-29.5.1	SUSE-SU-2017:3039-1
SLES 12 SP1	tomcat	8.0.43-10.24.1	SUSE-SU-2017:3279-1
SLES 12	tomcat	7.0.82-7.16.1	SUSE-SU-2017:3059-1

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP3	tomcat	8.0.43-29.5.1	SUSE-SU-2017:3039-1
SLES for SAP 12 SP2	tomcat	8.0.43-29.5.1	SUSE-SU-2017:3039-1
SLES for SAP 12 SP1	tomcat	8.0.43-10.24.1	SUSE-SU-2017:3279-1
SUSE OpenStack Cloud 6	tomcat	8.0.43-10.24.1	SUSE-SU-2017:3279-1

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	tomcat +9	7.0.76-3.el7_4	ELSA-2017-3081

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat	>= 9.0.0.M1, < 9.0.0.M22	9.0.0.M22	GHSA-73rx-3f9r-x949
Maven	org.apache.tomcat:tomcat	>= 8.5.0, < 8.5.16	8.5.16	GHSA-73rx-3f9r-x949
Maven	org.apache.tomcat:tomcat	>= 8.0.0.RC1, < 8.0.45	8.0.45	GHSA-73rx-3f9r-x949
Maven	org.apache.tomcat:tomcat	>= 7.0.41, < 7.0.79	7.0.79	GHSA-73rx-3f9r-x949

Advisories 10

RHSA-2017:1801 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2017:3081 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-3519-1 tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-3974-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1400-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2017:3039-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:3059-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:3279-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
ELSA-2017-3081 Important: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 30, 2017

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us
RHSA-2017:1801 vendor-advisory
[announce] 20170810 [SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning mailing-list
https://security.netapp.com/advisory/ntap-20180614-0003/
100280 vdb-entry
DSA-3974 vendor-advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update mailing-list
RHSA-2017:1802 vendor-advisory
RHSA-2017:3081 vendor-advisory
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context mailing-list
[tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list