CVE-2017-5651

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-5651
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5651.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-5651
Aliases
Published
2017-04-17T16:59:00.477Z
Modified
2026-07-08T11:48:46.420901Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.

References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
e37b977db6f47e4380ad67114a49e8568951c953
Last affected
45f8fd74cdb96490fab8709263a4d862f0d429cf
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "8.5.0"
        },
        {
            "last_affected": "8.5.0"
        },
        {
            "introduced": "8.5.1"
        },
        {
            "last_affected": "8.5.1"
        },
        {
            "introduced": "8.5.2"
        },
        {
            "last_affected": "8.5.2"
        },
        {
            "introduced": "8.5.3"
        },
        {
            "last_affected": "8.5.3"
        },
        {
            "introduced": "8.5.4"
        },
        {
            "last_affected": "8.5.4"
        },
        {
            "introduced": "8.5.5"
        },
        {
            "last_affected": "8.5.5"
        },
        {
            "introduced": "8.5.6"
        },
        {
            "last_affected": "8.5.6"
        },
        {
            "introduced": "8.5.7"
        },
        {
            "last_affected": "8.5.7"
        },
        {
            "introduced": "8.5.8"
        },
        {
            "last_affected": "8.5.8"
        },
        {
            "introduced": "8.5.9"
        },
        {
            "last_affected": "8.5.9"
        },
        {
            "introduced": "8.5.10"
        },
        {
            "last_affected": "8.5.10"
        },
        {
            "introduced": "8.5.11"
        },
        {
            "last_affected": "8.5.11"
        },
        {
            "introduced": "8.5.12"
        },
        {
            "last_affected": "8.5.12"
        },
        {
            "introduced": "9.0.0-milestone1"
        },
        {
            "last_affected": "9.0.0-milestone1"
        },
        {
            "introduced": "9.0.0-milestone10"
        },
        {
            "last_affected": "9.0.0-milestone10"
        },
        {
            "introduced": "9.0.0-milestone11"
        },
        {
            "last_affected": "9.0.0-milestone11"
        },
        {
            "introduced": "9.0.0-milestone12"
        },
        {
            "last_affected": "9.0.0-milestone12"
        },
        {
            "introduced": "9.0.0-milestone13"
        },
        {
            "last_affected": "9.0.0-milestone13"
        },
        {
            "introduced": "9.0.0-milestone14"
        },
        {
            "last_affected": "9.0.0-milestone14"
        },
        {
            "introduced": "9.0.0-milestone15"
        },
        {
            "last_affected": "9.0.0-milestone15"
        },
        {
            "introduced": "9.0.0-milestone16"
        },
        {
            "last_affected": "9.0.0-milestone16"
        },
        {
            "introduced": "9.0.0-milestone17"
        },
        {
            "last_affected": "9.0.0-milestone17"
        },
        {
            "introduced": "9.0.0-milestone18"
        },
        {
            "last_affected": "9.0.0-milestone18"
        },
        {
            "introduced": "9.0.0-milestone2"
        },
        {
            "last_affected": "9.0.0-milestone2"
        },
        {
            "introduced": "9.0.0-milestone3"
        },
        {
            "last_affected": "9.0.0-milestone3"
        },
        {
            "introduced": "9.0.0-milestone4"
        },
        {
            "last_affected": "9.0.0-milestone4"
        },
        {
            "introduced": "9.0.0-milestone5"
        },
        {
            "last_affected": "9.0.0-milestone5"
        },
        {
            "introduced": "9.0.0-milestone6"
        },
        {
            "last_affected": "9.0.0-milestone6"
        },
        {
            "introduced": "9.0.0-milestone7"
        },
        {
            "last_affected": "9.0.0-milestone7"
        },
        {
            "introduced": "9.0.0-milestone8"
        },
        {
            "last_affected": "9.0.0-milestone8"
        },
        {
            "introduced": "9.0.0-milestone9"
        },
        {
            "last_affected": "9.0.0-milestone9"
        }
    ]
}

Affected versions

8.*
8.5.0
8.5.1
8.5.10
8.5.11
8.5.12
8.5.2
8.5.3
8.5.4
8.5.5
8.5.6
8.5.7
8.5.8
8.5.9
9.*
9.0.0-milestone1
9.0.0-milestone10
9.0.0-milestone11
9.0.0-milestone12
9.0.0-milestone13
9.0.0-milestone14
9.0.0-milestone15
9.0.0-milestone16
9.0.0-milestone17
9.0.0-milestone18
9.0.0-milestone2
9.0.0-milestone3
9.0.0-milestone4
9.0.0-milestone5
9.0.0-milestone6
9.0.0-milestone7
9.0.0-milestone8
9.0.0-milestone9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5651.json"