CVE-2017-5651

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing

published April 17, 2017

CVSS
—
EPSS
8%
Percentile
94.6
In the wild
Unconfirmed
What it is

⚠️ A tiny slip in Apache Tomcat's send file processing could mean some requests get tangled up like socks in a dryer! 😅 Think of it like a restaurant where the same order is accidentally sent to the kitchen twice. If the chef isn't quick, you might end up with two identical dishes on your table – confusing, right? This vulnerability could lead to unexpected errors or responses getting mixed up, creating a frustrating experience for users and developers alike. Imagine users receiving data intended for someone else or an application hiccuping when it shouldn’t – not ideal!

Put simply

Think of it like a restaurant where the same order is accidentally sent to the kitchen twice. If the chef isn't quick, you might end up with two identical dishes on your table – confusing, right? In Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, a regression in the HTTP connectors allows the same Processor to be added to the processor cache twice, potentially leading to erratic behavior in response handling.

What to do

This vulnerability could lead to unexpected errors or responses getting mixed up, creating a frustrating experience for users and developers alike. Imagine users receiving data intended for someone else or an application hiccuping when it shouldn’t – not ideal! Upgrade to Apache Tomcat 9.0.0.M19 or later, and 8.5.13 or later to resolve this issue. Regularly review your caching mechanisms to ensure that processors aren't getting reused unexpectedly. You've got this! With these updates, you'll keep your Tomcat server running smoothly and users happy! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07752 · 94.6th percentile
Published
2017-04-17T16:00Z
EPSS history
Timeline
  • 17 APR 16:00Z
    In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing
    cvelistv5