"Resiliency Studio" is a self-service Resilience Validation Platform, which helps to identify failure points within a system, aids to engineer applications to be fault-tolerant with self-healing capabilities
Other
0
stars
0
forks
source link
CVE-2017-5651 (High) detected in tomcat-embed-core-8.5.11.jar #321
Path to dependency file: Resiliency-Studio/resiliency-studio-service/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.11/tomcat-embed-core-8.5.11.jar,/home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.11/tomcat-embed-core-8.5.11.jar,/home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.11/tomcat-embed-core-8.5.11.jar
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
CVE-2017-5651 - High Severity Vulnerability
Core Tomcat implementation
Library home page: http://tomcat.apache.org/
Path to dependency file: Resiliency-Studio/resiliency-studio-service/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.11/tomcat-embed-core-8.5.11.jar,/home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.11/tomcat-embed-core-8.5.11.jar,/home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.11/tomcat-embed-core-8.5.11.jar
Dependency Hierarchy: - sdk-java-rest-6.2.0.4-oss.jar (Root Library) - spring-boot-starter-tomcat-1.5.1.RELEASE.jar - :x: **tomcat-embed-core-8.5.11.jar** (Vulnerable Library)
Found in HEAD commit: 9809d9b7bfdc114eafb0a14d86667f3a76a014e8
Found in base branch: master
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
Publish Date: 2017-04-17
URL: CVE-2017-5651
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5651
Release Date: 2017-04-17
Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:9.0.0.M19,8.5.13,org.apache.tomcat:tomcat-coyote:9.0.0.M19,8.5.13