kritisch
CVE-2017-5648
tomcat: Calls to application listeners did not use the appropriate facade object
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat3.6CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Amazon (hoch), Oracle (hoch), Red Hat (mittel), Ubuntu (mittel).
Beschreibung
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| amazon linux 1 | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp und 17 weitere | 7.0.79-1.28.amzn1 und 1 weitere |
| debian 7 | tomcat7 | 7.0.28-4+deb7u12 |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+deb8u10 und 1 weitere |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp und 7 weitere | 7.0.69-12.el7_3 |
| Red Hat | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp und 9 weitere | kein Fix angegeben |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu2.2 |
Alle 52 Einträge aus 11 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| amazon linux 1 | tomcat7 | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat8 | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.0.43-1.70.amzn1 |
| debian 7 | tomcat7 | 7.0.28-4+deb7u12 |
| debian 8 | tomcat7 | 7.0.56-3+deb8u10 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u9 |
| Oracle Linux 7 | tomcat | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-lib | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-webapps | 7.0.69-12.el7_3 |
| Red Hat | tomcat7 | kein Fix angegeben |
| Red Hat | tomcat7-admin-webapps | kein Fix angegeben |
| Red Hat | tomcat7-docs-webapp | kein Fix angegeben |
| Red Hat | tomcat7-el-1.0-api | kein Fix angegeben |
| Red Hat | tomcat7-el-2.2-api | kein Fix angegeben |
| Red Hat | tomcat7-javadoc | kein Fix angegeben |
| Red Hat | tomcat7-jsp-2.2-api | kein Fix angegeben |
| Red Hat | tomcat7-lib | kein Fix angegeben |
| Red Hat | tomcat7-log4j | kein Fix angegeben |
| Red Hat | tomcat7-maven-devel | kein Fix angegeben |
| Red Hat | tomcat7-servlet-3.0-api | kein Fix angegeben |
| Red Hat | tomcat7-webapps | kein Fix angegeben |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu2.2 |
Referenzen
- http://www.debian.org/security/2017/dsa-3842
- http://www.debian.org/security/2017/dsa-3843
- http://www.openwall.com/lists/oss-security/2017/04/10/23
- http://www.openwall.com/lists/oss-security/2020/07/20/8
- http://www.securityfocus.com/bid/97530
- http://www.securitytracker.com/id/1038220
- https://access.redhat.com/errata/RHSA-2017:1801
- https://access.redhat.com/errata/RHSA-2017:1802
Alle 36 Referenzen
- https://access.redhat.com/errata/RHSA-2017:1809
- https://access.redhat.com/security/cve/CVE-2017-5648
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/0f7b9465d594b9814e1853d1e3a6e3aa51a21610
- https://github.com/apache/tomcat/commit/6bb36dfdf6444efda074893dff493b9eb3648808
- https://github.com/apache/tomcat/commit/dfa40863421d7681fed893b4256666491887e38c
- https://github.com/apache/tomcat80/commit/6d73b079c55ee25dea1bbd0556bb568a4247dacd
- https://linux.oracle.com/cve/CVE-2017-5648.html
- https://linux.oracle.com/errata/ELSA-2017-1809.html
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2017-5648
- https://security.gentoo.org/glsa/201705-09
- https://security.netapp.com/advisory/ntap-20180614-0001
- https://security.netapp.com/advisory/ntap-20180614-0001/
- https://ubuntu.com/security/notices/USN-3519-1
- https://web.archive.org/web/20170417124117/http://www.securityfocus.com/bid/97530
- https://web.archive.org/web/20170420115120/http://www.securitytracker.com/id/1038220
- https://www.cve.org/CVERecord?id=CVE-2017-5648