kritik
CVE-2017-5648
tomcat: Calls to application listeners did not use the appropriate facade object
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat3.6CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Amazon (yüksek), Oracle (yüksek), Red Hat (orta), Ubuntu (orta).
Açıklama
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| amazon linux 1 | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp ve 17 tane daha | 7.0.79-1.28.amzn1 ve 1 tane daha |
| debian 7 | tomcat7 | 7.0.28-4+deb7u12 |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+deb8u10 ve 1 tane daha |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp ve 7 tane daha | 7.0.69-12.el7_3 |
| Red Hat | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp ve 9 tane daha | düzeltme belirtilmemiş |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu2.2 |
11 kaynaktaki 52 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| amazon linux 1 | tomcat7 | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat8 | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.0.43-1.70.amzn1 |
| debian 7 | tomcat7 | 7.0.28-4+deb7u12 |
| debian 8 | tomcat7 | 7.0.56-3+deb8u10 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u9 |
| Oracle Linux 7 | tomcat | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-lib | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-webapps | 7.0.69-12.el7_3 |
| Red Hat | tomcat7 | düzeltme belirtilmemiş |
| Red Hat | tomcat7-admin-webapps | düzeltme belirtilmemiş |
| Red Hat | tomcat7-docs-webapp | düzeltme belirtilmemiş |
| Red Hat | tomcat7-el-1.0-api | düzeltme belirtilmemiş |
| Red Hat | tomcat7-el-2.2-api | düzeltme belirtilmemiş |
| Red Hat | tomcat7-javadoc | düzeltme belirtilmemiş |
| Red Hat | tomcat7-jsp-2.2-api | düzeltme belirtilmemiş |
| Red Hat | tomcat7-lib | düzeltme belirtilmemiş |
| Red Hat | tomcat7-log4j | düzeltme belirtilmemiş |
| Red Hat | tomcat7-maven-devel | düzeltme belirtilmemiş |
| Red Hat | tomcat7-servlet-3.0-api | düzeltme belirtilmemiş |
| Red Hat | tomcat7-webapps | düzeltme belirtilmemiş |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu2.2 |
Referanslar
- http://www.debian.org/security/2017/dsa-3842
- http://www.debian.org/security/2017/dsa-3843
- http://www.openwall.com/lists/oss-security/2017/04/10/23
- http://www.openwall.com/lists/oss-security/2020/07/20/8
- http://www.securityfocus.com/bid/97530
- http://www.securitytracker.com/id/1038220
- https://access.redhat.com/errata/RHSA-2017:1801
- https://access.redhat.com/errata/RHSA-2017:1802
36 referansın hepsi
- https://access.redhat.com/errata/RHSA-2017:1809
- https://access.redhat.com/security/cve/CVE-2017-5648
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/0f7b9465d594b9814e1853d1e3a6e3aa51a21610
- https://github.com/apache/tomcat/commit/6bb36dfdf6444efda074893dff493b9eb3648808
- https://github.com/apache/tomcat/commit/dfa40863421d7681fed893b4256666491887e38c
- https://github.com/apache/tomcat80/commit/6d73b079c55ee25dea1bbd0556bb568a4247dacd
- https://linux.oracle.com/cve/CVE-2017-5648.html
- https://linux.oracle.com/errata/ELSA-2017-1809.html
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2017-5648
- https://security.gentoo.org/glsa/201705-09
- https://security.netapp.com/advisory/ntap-20180614-0001
- https://security.netapp.com/advisory/ntap-20180614-0001/
- https://ubuntu.com/security/notices/USN-3519-1
- https://web.archive.org/web/20170417124117/http://www.securityfocus.com/bid/97530
- https://web.archive.org/web/20170420115120/http://www.securitytracker.com/id/1038220
- https://www.cve.org/CVERecord?id=CVE-2017-5648