Issue/Introduction:
There are the following Apache Tomcat vulnerabilities reported, i.e.
- CVE-2017-5651
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
- CVE-2017-5647
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. - CVE-2017-5650
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
- CVE-2017-5648
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
- CVE-2016-6808
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
Is Spectrum affected by the CVE-2017-5651, CVE-2017-5647, CVE-2017-5650, CVE-2017-5648, CVE-2016-6808 Apache Tomcat vulnerabilities?
Environment:
Release: SDBSFO99000-10.2-Spectrum-Device Based Suite-Server FOC
Component:
Resolution:
Spectrum 10.2.x are using Apache Tomcat 7.0.72. Below vulnerabilities don't affect Tomcat 7.0.72, thus Spectrum is not affected.
- CVE-2017-5651
- CVE-2017-5650
Spectrum Engineering has also confirmed that Spectrum is not affected by the following vulnerabilities.
- CVE-2016-6808
- CVE-2017-5647
Spectrum 10.2.x is affected by the CVE-2017-5648 vulnerability. This has been addressed in Spectrum 10.3.x