CVE-2017-5647
Description
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
3.726
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Update Tomcat to 9.5.14 | Windows |
| Update Tomcat to 9.5.5 | Windows |
| Update Tomcat to 9.5.7 | Windows |
| Update Tomcat to 9.5.8 | Windows |
| Update Tomcat to 9.6.10 | Windows |
| Update Tomcat to 9.6.3 | Windows |
| Update Tomcat to 9.6.4 | Windows |
| Update Tomcat to 9.6.7 | Windows |
| Update Tomcat to 9.6.8 | Windows |
| Update Tomcat to 2.4.5 | Windows |
| Update Tomcat to 3.0.14 | Windows |
| Vulnerabilities CVE-2017-5647,CVE-2017-5650 are fixed in Apache - tomcat 9.0.0 | Windows |
| Vulnerabilities CVE-2017-5647,CVE-2017-5650 are fixed in Apache - tomcat 8.5.13 | Windows |
| Vulnerabilities CVE-2017-5647 are fixed in Apache - tomcat 7.0.77 | Windows |
| Vulnerabilities CVE-2017-5647 are fixed in Apache - tomcat 6.0.53 | Windows |
| Vulnerabilities CVE-2017-5647 are fixed in Apache - tomcat 8.0.43 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2.6.5 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.4 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.0.6 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.2 | Windows |
| Multiple Vulnerabilities are affected in IBM UrbanCode Deploy 6.1.3.6 | Windows |
| Vulnerabilities CVE-2017-1493,CVE-2017-5647,CVE-2017-5650 are affected in IBM UrbanCode Deploy 6.2.4.0 | Windows |
| Servlet and JSP engine (USN-3519-1) tomcat7_7.0.52-1ubuntu0.13_all.deb | Linux |
| Servlet and JSP engine (USN-3519-1) tomcat8_8.0.32-1ubuntu1.5_all.deb | Linux |
| Servlet and JSP engine (USN-3519-1) tomcat8_8.0.38-2ubuntu2.2_all.deb | Linux |
| Servlet and JSP engine (USN-3519-1) libtomcat7-java_7.0.52-1ubuntu0.13_all.deb | Linux |
| Servlet and JSP engine (USN-3519-1) libtomcat8-java_8.0.32-1ubuntu1.5_all.deb | Linux |
| Servlet and JSP engine (USN-3519-1) libtomcat8-java_8.0.38-2ubuntu2.2_all.deb | Linux |
| tomcat7 security update(DSA-3842-1) tomcat7_7.0.56-3+deb8u10_all.deb | Linux |
| tomcat8 security update(DSA-3843-1) tomcat8_8.0.14-1+deb8u9_all.deb | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-6.0.24-111.el6_9.noarch.rpm | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-lib-6.0.24-111.el6_9.noarch.rpm | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm | Linux |
| Tomcat6 security update (CESA-2016:2045) tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3080) Important: tomcat6 security update tomcat6-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3080) Important: tomcat6 security update tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3080) Important: tomcat6 security update tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3080) Important: tomcat6 security update tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3080) Important: tomcat6 security update tomcat6-lib-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3080) Important: tomcat6 security update tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3081) Important: tomcat security update tomcat-7.0.76-3.el7_4.noarch.rpm | Linux |
| (RHSA-2017:3081) Important: tomcat security update tomcat-admin-webapps-7.0.76-3.el7_4.noarch.rpm | Linux |
| (RHSA-2017:3081) Important: tomcat security update tomcat-docs-webapp-7.0.76-3.el7_4.noarch.rpm | Linux |
| (RHSA-2017:3081) Important: tomcat security update tomcat-javadoc-7.0.76-3.el7_4.noarch.rpm | Linux |
| (RHSA-2017:3081) Important: tomcat security update tomcat-jsvc-7.0.76-3.el7_4.noarch.rpm | Linux |
| (RHSA-2017:3081) Important: tomcat security update tomcat-lib-7.0.76-3.el7_4.noarch.rpm | Linux |
| (RHSA-2017:3081) Important: tomcat security update tomcat-webapps-7.0.76-3.el7_4.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-8.0.43-10.19.1.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-admin-webapps-8.0.43-10.19.1.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-docs-webapp-8.0.43-10.19.1.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-el-3_0-api-8.0.43-10.19.1.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-javadoc-8.0.43-10.19.1.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-jsp-2_3-api-8.0.43-10.19.1.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-lib-8.0.43-10.19.1.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-servlet-3_1-api-8.0.43-10.19.1.noarch.rpm | Linux |
| SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-webapps-8.0.43-10.19.1.noarch.rpm | Linux |
| (RHSA-2017:3080) tomcat6 security update tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3080) tomcat6 security update tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm | Linux |
| (RHSA-2017:3080) tomcat6 security update tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm | Linux |
| Update Tomcat to 9.5.14 (For Linux) | Linux |
| Update Tomcat to 9.5.5 (For Linux) | Linux |
| Update Tomcat to 9.5.7 (For Linux) | Linux |
| Update Tomcat to 9.5.8 (For Linux) | Linux |
| Update Tomcat to 9.6.10 (For Linux) | Linux |
| Update Tomcat to 9.6.3 (For Linux) | Linux |
| Update Tomcat to 9.6.4 (For Linux) | Linux |
| Update Tomcat to 9.6.7 (For Linux) | Linux |
| Update Tomcat to 9.6.8 (For Linux) | Linux |
| Update Tomcat to 2.4.5 (For Linux) | Linux |
| Update Tomcat to 3.0.14 (For Linux) | Linux |
| (CESA-2017:3081) Important: tomcat security update tomcat-7.0.76-3.el7_4.noarch.rpm | Linux |
| (CESA-2017:3081) Important: tomcat security update tomcat-admin-webapps-7.0.76-3.el7_4.noarch.rpm | Linux |
| (CESA-2017:3081) Important: tomcat security update tomcat-docs-webapp-7.0.76-3.el7_4.noarch.rpm | Linux |
| (CESA-2017:3081) Important: tomcat security update tomcat-javadoc-7.0.76-3.el7_4.noarch.rpm | Linux |
| (CESA-2017:3081) Important: tomcat security update tomcat-jsvc-7.0.76-3.el7_4.noarch.rpm | Linux |
| (CESA-2017:3081) Important: tomcat security update tomcat-lib-7.0.76-3.el7_4.noarch.rpm | Linux |
| (CESA-2017:3081) Important: tomcat security update tomcat-webapps-7.0.76-3.el7_4.noarch.rpm | Linux |
| Vulnerabilities CVE-2017-5647,CVE-2017-5650 are fixed in Apache - tomcat for Linux 9.0.0 | Linux |
| Vulnerabilities CVE-2017-5647,CVE-2017-5650 are fixed in Apache - tomcat for Linux 8.5.13 | Linux |
| Vulnerabilities CVE-2017-5647 are fixed in Apache - tomcat for Linux 7.0.77 | Linux |
| Vulnerabilities CVE-2017-5647 are fixed in Apache - tomcat for Linux 6.0.53 | Linux |
| Vulnerabilities CVE-2017-5647 are fixed in Apache - tomcat for Linux 8.0.43 | Linux |
| Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-5647) | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234