critical
CVE-2017-5648
tomcat: Calls to application listeners did not use the appropriate facade object
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat3.6CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Amazon (high), Oracle (high), Red Hat (medium), Ubuntu (medium).
Description
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| amazon linux 1 | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp and 17 more | 7.0.79-1.28.amzn1 and 1 more |
| debian 7 | tomcat7 | 7.0.28-4+deb7u12 |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+deb8u10 and 1 more |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 7 more | 7.0.69-12.el7_3 |
| Red Hat | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp and 9 more | no fix listed |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu2.2 |
Show all 52 entries from 11 sources
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76 |
| amazon linux 1 | tomcat7 | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.79-1.28.amzn1 |
| amazon linux 1 | tomcat8 | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.0.43-1.70.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.0.43-1.70.amzn1 |
| debian 7 | tomcat7 | 7.0.28-4+deb7u12 |
| debian 8 | tomcat7 | 7.0.56-3+deb8u10 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u9 |
| Oracle Linux 7 | tomcat | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-lib | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.69-12.el7_3 |
| Oracle Linux 7 | tomcat-webapps | 7.0.69-12.el7_3 |
| Red Hat | tomcat7 | no fix listed |
| Red Hat | tomcat7-admin-webapps | no fix listed |
| Red Hat | tomcat7-docs-webapp | no fix listed |
| Red Hat | tomcat7-el-1.0-api | no fix listed |
| Red Hat | tomcat7-el-2.2-api | no fix listed |
| Red Hat | tomcat7-javadoc | no fix listed |
| Red Hat | tomcat7-jsp-2.2-api | no fix listed |
| Red Hat | tomcat7-lib | no fix listed |
| Red Hat | tomcat7-log4j | no fix listed |
| Red Hat | tomcat7-maven-devel | no fix listed |
| Red Hat | tomcat7-servlet-3.0-api | no fix listed |
| Red Hat | tomcat7-webapps | no fix listed |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.13 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.5 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu2.2 |
References
- http://www.debian.org/security/2017/dsa-3842
- http://www.debian.org/security/2017/dsa-3843
- http://www.openwall.com/lists/oss-security/2017/04/10/23
- http://www.openwall.com/lists/oss-security/2020/07/20/8
- http://www.securityfocus.com/bid/97530
- http://www.securitytracker.com/id/1038220
- https://access.redhat.com/errata/RHSA-2017:1801
- https://access.redhat.com/errata/RHSA-2017:1802
All 36 references
- https://access.redhat.com/errata/RHSA-2017:1809
- https://access.redhat.com/security/cve/CVE-2017-5648
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/0f7b9465d594b9814e1853d1e3a6e3aa51a21610
- https://github.com/apache/tomcat/commit/6bb36dfdf6444efda074893dff493b9eb3648808
- https://github.com/apache/tomcat/commit/dfa40863421d7681fed893b4256666491887e38c
- https://github.com/apache/tomcat80/commit/6d73b079c55ee25dea1bbd0556bb568a4247dacd
- https://linux.oracle.com/cve/CVE-2017-5648.html
- https://linux.oracle.com/errata/ELSA-2017-1809.html
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2017-5648
- https://security.gentoo.org/glsa/201705-09
- https://security.netapp.com/advisory/ntap-20180614-0001
- https://security.netapp.com/advisory/ntap-20180614-0001/
- https://ubuntu.com/security/notices/USN-3519-1
- https://web.archive.org/web/20170417124117/http://www.securityfocus.com/bid/97530
- https://web.archive.org/web/20170420115120/http://www.securitytracker.com/id/1038220
- https://www.cve.org/CVERecord?id=CVE-2017-5648