critique
CVE-2017-5648
tomcat: Calls to application listeners did not use the appropriate facade object
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat3.6CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Amazon (élevée), Oracle (élevée), Red Hat (moyenne), Ubuntu (moyenne).
Description
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| amazon linux 1 | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp et 17 autres | 7.0.79-1.28.amzn1 et 1 autres |
| debian 7 | tomcat7 | 7.0.28-4+deb7u12 |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+deb8u10 et 1 autres |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp et 7 autres | 7.0.69-12.el7_3 |
| Red Hat | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp et 9 autres | pas de correctif indiqué |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu2.2 |
Afficher les 52 entrées de 11 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| amazon linux 1 | tomcat7 | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat8 | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.0.43-1.70.amzn1 |
| debian 7 | tomcat7 | 7.0.28-4+deb7u12 |
| debian 8 | tomcat7 | 7.0.56-3+deb8u10 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u9 |
| Oracle Linux 7 | tomcat | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-lib | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-webapps | 7.0.69-12.el7_3 |
| Red Hat | tomcat7 | pas de correctif indiqué |
| Red Hat | tomcat7-admin-webapps | pas de correctif indiqué |
| Red Hat | tomcat7-docs-webapp | pas de correctif indiqué |
| Red Hat | tomcat7-el-1.0-api | pas de correctif indiqué |
| Red Hat | tomcat7-el-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat7-javadoc | pas de correctif indiqué |
| Red Hat | tomcat7-jsp-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat7-lib | pas de correctif indiqué |
| Red Hat | tomcat7-log4j | pas de correctif indiqué |
| Red Hat | tomcat7-maven-devel | pas de correctif indiqué |
| Red Hat | tomcat7-servlet-3.0-api | pas de correctif indiqué |
| Red Hat | tomcat7-webapps | pas de correctif indiqué |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu2.2 |
Références
- http://www.debian.org/security/2017/dsa-3842
- http://www.debian.org/security/2017/dsa-3843
- http://www.openwall.com/lists/oss-security/2017/04/10/23
- http://www.openwall.com/lists/oss-security/2020/07/20/8
- http://www.securityfocus.com/bid/97530
- http://www.securitytracker.com/id/1038220
- https://access.redhat.com/errata/RHSA-2017:1801
- https://access.redhat.com/errata/RHSA-2017:1802
Les 36 références
- https://access.redhat.com/errata/RHSA-2017:1809
- https://access.redhat.com/security/cve/CVE-2017-5648
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/0f7b9465d594b9814e1853d1e3a6e3aa51a21610
- https://github.com/apache/tomcat/commit/6bb36dfdf6444efda074893dff493b9eb3648808
- https://github.com/apache/tomcat/commit/dfa40863421d7681fed893b4256666491887e38c
- https://github.com/apache/tomcat80/commit/6d73b079c55ee25dea1bbd0556bb568a4247dacd
- https://linux.oracle.com/cve/CVE-2017-5648.html
- https://linux.oracle.com/errata/ELSA-2017-1809.html
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2017-5648
- https://security.gentoo.org/glsa/201705-09
- https://security.netapp.com/advisory/ntap-20180614-0001
- https://security.netapp.com/advisory/ntap-20180614-0001/
- https://ubuntu.com/security/notices/USN-3519-1
- https://web.archive.org/web/20170417124117/http://www.securityfocus.com/bid/97530
- https://web.archive.org/web/20170420115120/http://www.securitytracker.com/id/1038220
- https://www.cve.org/CVERecord?id=CVE-2017-5648