{"id":"CVE-2017-5651","published":"2017-04-17T16:00:00Z","modified":"2024-08-05T15:11:47Z","title":"In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a…","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.07752,"percentile":0.94621,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/97544","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://security.gentoo.org/glsa/201705-09","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/6694538826b87522fb723d2dcedd537e14ebe0a381d92e5525a531d8%40%3Cannounce.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.securitytracker.com/id/1038219","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["x_refsource_CONFIRM"]},{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=60918","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":18.9,"factors":[{"name":"EPSS percentile","points":18.92}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":["9.0.0.M1 to 9.0.0.M18","8.5.0 to 8.5.12"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=9.0.0.M1, <9.0.0.M19",">=8.5.0, <8.5.13"],"patched":["9.0.0.M19","8.5.13"],"from":["GHSA-9hg2-395j-83rm"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0.M1, <9.0.0.M19",">=8.5.0, <8.5.13"],"patched":["9.0.0.M19","8.5.13"],"from":["GHSA-9hg2-395j-83rm"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3384","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-5647","parents":[{"from":"CVE-2017-5647","to":"CVE-2017-5651","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http11/Http11Processor.java"],"commits":["https://github.com/apache/tomcat/commit/864aa1199ad2cccc9a7e7c6b977f7d7f812c9910","https://github.com/apache/tomcat/commit/a4efd3ca1ccbdfc398136d76c0d8b7ad5a1e4905","https://github.com/apache/tomcat/commit/494429ca210641b6b7affe89a2b0a6c0ff70109b","https://github.com/apache/tomcat/commit/9233d9d6a018be4415d4d7d6cb4fe01176adf1a8"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2017-5651","to":"CVE-2021-33037","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http11/Http11Processor.java"],"commits":["https://github.com/apache/tomcat/commit/494429ca210641b6b7affe89a2b0a6c0ff70109b","https://github.com/apache/tomcat/commit/9233d9d6a018be4415d4d7d6cb4fe01176adf1a8","https://github.com/apache/tomcat/commit/05f9e8b00f5d9251fcd3c95dcfd6cf84177f46c8","https://github.com/apache/tomcat/commit/19d11556d0db99df291df33605f137976d152475"],"basis":"shared function","functions":["prepareRequest"]}]}],"packageHistory":[{"cve":"CVE-2023-28709","published":"2023-05-22","fixed":"8.5.88","kev":false},{"cve":"CVE-2023-34981","published":"2023-06-21","fixed":"8.5.89","kev":false},{"cve":"CVE-2016-6816","published":"2017-03-20","fixed":"9.0.0.M12","kev":false,"link":{"from":"CVE-2016-6816","to":"CVE-2017-5651","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.0.M12","toFixed":"9.0.0.M19","daysApart":28},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"8.5.8","toFixed":"8.5.13","daysApart":28}]}},{"cve":"CVE-2017-5651","published":"2017-04-17","fixed":"9.0.0.M19","kev":false},{"cve":"CVE-2019-0199","published":"2019-04-10","fixed":"9.0.16","kev":false,"link":{"from":"CVE-2017-5651","to":"CVE-2019-0199","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"8.5.13","toFixed":"8.5.38","daysApart":723}]}},{"cve":"CVE-2024-21733","published":"2024-01-19","fixed":"9.0.44","kev":false},{"cve":"CVE-2023-42794","published":"2023-10-10","fixed":"9.0.81","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-coyote"}}