CVE-2017-5651 — Expected Behavior Violation in Software Foundation Apache Tomcat

CWE-440 — Expected Behavior Violation8 documents8 sources
Severity
9.8CRITICALNVD
EPSS
9.8%
top 7.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache TomcatApache Tomcat
Timeline
PublishedApr 17
Latest updateMay 13

Description

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDapache/tomcat14 versions+13
▶CVEListV5apache_software_foundation/apache_tomcat8.5.0 to 8.5.12, 9.0.0.M1 to 9.0.0.M18+1

Patches

Patch: bz.apache.org ↗Patch: bz.apache.org ↗

🔴Vulnerability Details

3
GHSA
Expected Behavior Violation in Apache Tomcat↗2022-05-13
▶
OSV
Expected Behavior Violation in Apache Tomcat↗2022-05-13
▶
CVEList
CVE-2017-5651: In Apache Tomcat 9↗2017-04-17
▶

📋Vendor Advisories

3
Red Hat
tomcat: Incorrect handling of send file processing could result into adding Processort to the cache twice↗2017-04-10
▶
Debian
CVE-2017-5651: tomcat9 - In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of t...↗2017
▶
Apache
Apache tomcat: CVE-2017-5651↗
▶

💬Community

1
Bugzilla
CVE-2017-5651 tomcat: Incorrect handling of send file processing could result into adding Processort to the cache twice↗2017-04-11
▶
CVE-2017-5651 — Expected Behavior Violation | cvebase