CVE-2017-5647
Summary
| CVE | CVE-2017-5647 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-04-17 16:59:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. |
Risk And Classification
Primary CVSS: v3.0 7.5 HIGH from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-200 | unspecified
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Tomcat | 6.0.0 | All | All | All |
| Application | Apache | Tomcat | 6.0.1 | All | All | All |
| Application | Apache | Tomcat | 6.0.10 | All | All | All |
| Application | Apache | Tomcat | 6.0.11 | All | All | All |
| Application | Apache | Tomcat | 6.0.12 | All | All | All |
| Application | Apache | Tomcat | 6.0.13 | All | All | All |
| Application | Apache | Tomcat | 6.0.14 | All | All | All |
| Application | Apache | Tomcat | 6.0.15 | All | All | All |
| Application | Apache | Tomcat | 6.0.16 | All | All | All |
| Application | Apache | Tomcat | 6.0.17 | All | All | All |
| Application | Apache | Tomcat | 6.0.18 | All | All | All |
| Application | Apache | Tomcat | 6.0.19 | All | All | All |
| Application | Apache | Tomcat | 6.0.2 | All | All | All |
| Application | Apache | Tomcat | 6.0.20 | All | All | All |
| Application | Apache | Tomcat | 6.0.21 | All | All | All |
| Application | Apache | Tomcat | 6.0.22 | All | All | All |
| Application | Apache | Tomcat | 6.0.23 | All | All | All |
| Application | Apache | Tomcat | 6.0.24 | All | All | All |
| Application | Apache | Tomcat | 6.0.25 | All | All | All |
| Application | Apache | Tomcat | 6.0.26 | All | All | All |
| Application | Apache | Tomcat | 6.0.27 | All | All | All |
| Application | Apache | Tomcat | 6.0.28 | All | All | All |
| Application | Apache | Tomcat | 6.0.29 | All | All | All |
| Application | Apache | Tomcat | 6.0.3 | All | All | All |
| Application | Apache | Tomcat | 6.0.30 | All | All | All |
| Application | Apache | Tomcat | 6.0.31 | All | All | All |
| Application | Apache | Tomcat | 6.0.32 | All | All | All |
| Application | Apache | Tomcat | 6.0.33 | All | All | All |
| Application | Apache | Tomcat | 6.0.34 | All | All | All |
| Application | Apache | Tomcat | 6.0.35 | All | All | All |
| Application | Apache | Tomcat | 6.0.36 | All | All | All |
| Application | Apache | Tomcat | 6.0.37 | All | All | All |
| Application | Apache | Tomcat | 6.0.38 | All | All | All |
| Application | Apache | Tomcat | 6.0.39 | All | All | All |
| Application | Apache | Tomcat | 6.0.4 | All | All | All |
| Application | Apache | Tomcat | 6.0.40 | All | All | All |
| Application | Apache | Tomcat | 6.0.41 | All | All | All |
| Application | Apache | Tomcat | 6.0.42 | All | All | All |
| Application | Apache | Tomcat | 6.0.43 | All | All | All |
| Application | Apache | Tomcat | 6.0.44 | All | All | All |
| Application | Apache | Tomcat | 6.0.45 | All | All | All |
| Application | Apache | Tomcat | 6.0.46 | All | All | All |
| Application | Apache | Tomcat | 6.0.47 | All | All | All |
| Application | Apache | Tomcat | 6.0.48 | All | All | All |
| Application | Apache | Tomcat | 6.0.49 | All | All | All |
| Application | Apache | Tomcat | 6.0.5 | All | All | All |
| Application | Apache | Tomcat | 6.0.50 | All | All | All |
| Application | Apache | Tomcat | 6.0.51 | All | All | All |
| Application | Apache | Tomcat | 6.0.52 | All | All | All |
| Application | Apache | Tomcat | 6.0.6 | All | All | All |
| Application | Apache | Tomcat | 6.0.7 | All | All | All |
| Application | Apache | Tomcat | 6.0.8 | All | All | All |
| Application | Apache | Tomcat | 6.0.9 | All | All | All |
| Application | Apache | Tomcat | 7.0.0 | All | All | All |
| Application | Apache | Tomcat | 7.0.1 | All | All | All |
| Application | Apache | Tomcat | 7.0.10 | All | All | All |
| Application | Apache | Tomcat | 7.0.11 | All | All | All |
| Application | Apache | Tomcat | 7.0.12 | All | All | All |
| Application | Apache | Tomcat | 7.0.13 | All | All | All |
| Application | Apache | Tomcat | 7.0.14 | All | All | All |
| Application | Apache | Tomcat | 7.0.15 | All | All | All |
| Application | Apache | Tomcat | 7.0.16 | All | All | All |
| Application | Apache | Tomcat | 7.0.17 | All | All | All |
| Application | Apache | Tomcat | 7.0.18 | All | All | All |
| Application | Apache | Tomcat | 7.0.19 | All | All | All |
| Application | Apache | Tomcat | 7.0.2 | All | All | All |
| Application | Apache | Tomcat | 7.0.20 | All | All | All |
| Application | Apache | Tomcat | 7.0.21 | All | All | All |
| Application | Apache | Tomcat | 7.0.22 | All | All | All |
| Application | Apache | Tomcat | 7.0.23 | All | All | All |
| Application | Apache | Tomcat | 7.0.24 | All | All | All |
| Application | Apache | Tomcat | 7.0.25 | All | All | All |
| Application | Apache | Tomcat | 7.0.26 | All | All | All |
| Application | Apache | Tomcat | 7.0.27 | All | All | All |
| Application | Apache | Tomcat | 7.0.28 | All | All | All |
| Application | Apache | Tomcat | 7.0.29 | All | All | All |
| Application | Apache | Tomcat | 7.0.3 | All | All | All |
| Application | Apache | Tomcat | 7.0.30 | All | All | All |
| Application | Apache | Tomcat | 7.0.31 | All | All | All |
| Application | Apache | Tomcat | 7.0.32 | All | All | All |
| Application | Apache | Tomcat | 7.0.33 | All | All | All |
| Application | Apache | Tomcat | 7.0.34 | All | All | All |
| Application | Apache | Tomcat | 7.0.35 | All | All | All |
| Application | Apache | Tomcat | 7.0.36 | All | All | All |
| Application | Apache | Tomcat | 7.0.37 | All | All | All |
| Application | Apache | Tomcat | 7.0.38 | All | All | All |
| Application | Apache | Tomcat | 7.0.39 | All | All | All |
| Application | Apache | Tomcat | 7.0.4 | All | All | All |
| Application | Apache | Tomcat | 7.0.40 | All | All | All |
| Application | Apache | Tomcat | 7.0.41 | All | All | All |
| Application | Apache | Tomcat | 7.0.42 | All | All | All |
| Application | Apache | Tomcat | 7.0.43 | All | All | All |
| Application | Apache | Tomcat | 7.0.44 | All | All | All |
| Application | Apache | Tomcat | 7.0.45 | All | All | All |
| Application | Apache | Tomcat | 7.0.46 | All | All | All |
| Application | Apache | Tomcat | 7.0.47 | All | All | All |
| Application | Apache | Tomcat | 7.0.48 | All | All | All |
| Application | Apache | Tomcat | 7.0.49 | All | All | All |
| Application | Apache | Tomcat | 7.0.5 | All | All | All |
| Application | Apache | Tomcat | 7.0.50 | All | All | All |
| Application | Apache | Tomcat | 7.0.51 | All | All | All |
| Application | Apache | Tomcat | 7.0.52 | All | All | All |
| Application | Apache | Tomcat | 7.0.53 | All | All | All |
| Application | Apache | Tomcat | 7.0.54 | All | All | All |
| Application | Apache | Tomcat | 7.0.55 | All | All | All |
| Application | Apache | Tomcat | 7.0.56 | All | All | All |
| Application | Apache | Tomcat | 7.0.57 | All | All | All |
| Application | Apache | Tomcat | 7.0.58 | All | All | All |
| Application | Apache | Tomcat | 7.0.59 | All | All | All |
| Application | Apache | Tomcat | 7.0.6 | All | All | All |
| Application | Apache | Tomcat | 7.0.60 | All | All | All |
| Application | Apache | Tomcat | 7.0.61 | All | All | All |
| Application | Apache | Tomcat | 7.0.62 | All | All | All |
| Application | Apache | Tomcat | 7.0.63 | All | All | All |
| Application | Apache | Tomcat | 7.0.64 | All | All | All |
| Application | Apache | Tomcat | 7.0.65 | All | All | All |
| Application | Apache | Tomcat | 7.0.66 | All | All | All |
| Application | Apache | Tomcat | 7.0.67 | All | All | All |
| Application | Apache | Tomcat | 7.0.68 | All | All | All |
| Application | Apache | Tomcat | 7.0.69 | All | All | All |
| Application | Apache | Tomcat | 7.0.7 | All | All | All |
| Application | Apache | Tomcat | 7.0.70 | All | All | All |
| Application | Apache | Tomcat | 7.0.71 | All | All | All |
| Application | Apache | Tomcat | 7.0.72 | All | All | All |
| Application | Apache | Tomcat | 7.0.73 | All | All | All |
| Application | Apache | Tomcat | 7.0.74 | All | All | All |
| Application | Apache | Tomcat | 7.0.75 | All | All | All |
| Application | Apache | Tomcat | 7.0.76 | All | All | All |
| Application | Apache | Tomcat | 7.0.8 | All | All | All |
| Application | Apache | Tomcat | 7.0.9 | All | All | All |
| Application | Apache | Tomcat | 8.0.0 | All | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc1 | All | All |
| Application | Apache | Tomcat | 8.0.1 | All | All | All |
| Application | Apache | Tomcat | 8.0.10 | All | All | All |
| Application | Apache | Tomcat | 8.0.11 | All | All | All |
| Application | Apache | Tomcat | 8.0.12 | All | All | All |
| Application | Apache | Tomcat | 8.0.13 | All | All | All |
| Application | Apache | Tomcat | 8.0.14 | All | All | All |
| Application | Apache | Tomcat | 8.0.15 | All | All | All |
| Application | Apache | Tomcat | 8.0.16 | All | All | All |
| Application | Apache | Tomcat | 8.0.17 | All | All | All |
| Application | Apache | Tomcat | 8.0.18 | All | All | All |
| Application | Apache | Tomcat | 8.0.19 | All | All | All |
| Application | Apache | Tomcat | 8.0.2 | All | All | All |
| Application | Apache | Tomcat | 8.0.20 | All | All | All |
| Application | Apache | Tomcat | 8.0.21 | All | All | All |
| Application | Apache | Tomcat | 8.0.22 | All | All | All |
| Application | Apache | Tomcat | 8.0.23 | All | All | All |
| Application | Apache | Tomcat | 8.0.24 | All | All | All |
| Application | Apache | Tomcat | 8.0.25 | All | All | All |
| Application | Apache | Tomcat | 8.0.26 | All | All | All |
| Application | Apache | Tomcat | 8.0.27 | All | All | All |
| Application | Apache | Tomcat | 8.0.28 | All | All | All |
| Application | Apache | Tomcat | 8.0.29 | All | All | All |
| Application | Apache | Tomcat | 8.0.3 | All | All | All |
| Application | Apache | Tomcat | 8.0.30 | All | All | All |
| Application | Apache | Tomcat | 8.0.31 | All | All | All |
| Application | Apache | Tomcat | 8.0.32 | All | All | All |
| Application | Apache | Tomcat | 8.0.33 | All | All | All |
| Application | Apache | Tomcat | 8.0.34 | All | All | All |
| Application | Apache | Tomcat | 8.0.35 | All | All | All |
| Application | Apache | Tomcat | 8.0.36 | All | All | All |
| Application | Apache | Tomcat | 8.0.37 | All | All | All |
| Application | Apache | Tomcat | 8.0.38 | All | All | All |
| Application | Apache | Tomcat | 8.0.39 | All | All | All |
| Application | Apache | Tomcat | 8.0.4 | All | All | All |
| Application | Apache | Tomcat | 8.0.40 | All | All | All |
| Application | Apache | Tomcat | 8.0.41 | All | All | All |
| Application | Apache | Tomcat | 8.0.42 | All | All | All |
| Application | Apache | Tomcat | 8.0.5 | All | All | All |
| Application | Apache | Tomcat | 8.0.6 | All | All | All |
| Application | Apache | Tomcat | 8.0.7 | All | All | All |
| Application | Apache | Tomcat | 8.0.8 | All | All | All |
| Application | Apache | Tomcat | 8.0.9 | All | All | All |
| Application | Apache | Tomcat | 8.5.0 | All | All | All |
| Application | Apache | Tomcat | 8.5.1 | All | All | All |
| Application | Apache | Tomcat | 8.5.10 | All | All | All |
| Application | Apache | Tomcat | 8.5.11 | All | All | All |
| Application | Apache | Tomcat | 8.5.12 | All | All | All |
| Application | Apache | Tomcat | 8.5.2 | All | All | All |
| Application | Apache | Tomcat | 8.5.3 | All | All | All |
| Application | Apache | Tomcat | 8.5.4 | All | All | All |
| Application | Apache | Tomcat | 8.5.5 | All | All | All |
| Application | Apache | Tomcat | 8.5.6 | All | All | All |
| Application | Apache | Tomcat | 8.5.7 | All | All | All |
| Application | Apache | Tomcat | 8.5.8 | All | All | All |
| Application | Apache | Tomcat | 8.5.9 | All | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone1 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone10 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone11 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone12 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone13 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone14 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone15 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone16 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone17 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone18 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone2 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone3 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone4 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone5 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone6 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone7 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone8 | All | All |
| Application | Apache | Tomcat | 9.0.0 | milestone9 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache Tomcat | affected 9.0.0.M1 to 9.0.0.M18 | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected 8.5.0 to 8.5.12 | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected 8.0.0.RC1 to 8.0.42 | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected 7.0.0 to 7.0.76 | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected 6.0.0 to 6.0.52 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.arubanetworks.com/assets/alert/HPESBHF03730.txt | af854a3a-2127-422b-91ae-364da2661108 | www.arubanetworks.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Document Display | HPE Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20566.www2.hpe.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Oracle Critical Patch Update - July 2019 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Apache Tomcat Pipelined Request Send File Bug Lets Remote Users Obtain Potentially Sensitive Information on the Target System - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Debian -- Security Information -- DSA-3842-1 tomcat7 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Apache Tomcat: Multiple vulnerabilities (GLSA 201705-09) — Gentoo Security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| March 2017 Apache Tomcat Vulnerabilities in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Oracle Critical Patch Update - July 2017 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | |
| Debian -- Security Information -- DSA-3843-1 tomcat8 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 378318 Virtuozzo Linux Security Update for tomcat6-lib (VZLSA-2017:3080)