https://bugzilla.redhat.com/show_bug.cgi?id=1441205
Bug ID: 1441205
Summary: CVE-2017-5647 tomcat: Incorrect handling of pipelined
requests when send file was used
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, bbaranow(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
etirelli(a)redhat.com, felias(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hhorak(a)redhat.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, joelsmith(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mbabacek(a)redhat.com,
mbaluch(a)redhat.com, me(a)coolsvap.net,
mizdebsk(a)redhat.com, mwinkler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
psotirop(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trick(a)vanstaveren.us, twalsh(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
A bug in the handling of the pipelined requests when send file was used
resulted in the pipelined request being lost when send file processing of the
previous request completed. This could result in responses appearing to be sent
for the wrong request. For example, a user agent that sent requests A, B and C
could see the correct response for request A, the response for request C for
request B and no response for request C.
Affected versions: 6.0.0 to 6.0.52, 7.0.0 to 7.0.76, 8.0.0.RC1 to 8.0.42
Fixed in revisions:
Tomcat 6:
https://svn.apache.org/viewvc?view=revision&revision=1789024
https://svn.apache.org/viewvc?view=revision&revision=1789155
https://svn.apache.org/viewvc?view=revision&revision=1789856
Tomcat 7:
https://svn.apache.org/viewvc?view=revision&revision=1789008
Tomcat 8:
https://svn.apache.org/viewvc?view=revision&revision=1788999
References:
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.53
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.77
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.43
--
You are receiving this mail because:
You are on the CC list for the bug.