Search for packages
| purl | pkg:apache/tomcat@9.0.0%2BM18 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3pmw-yhnf-aaaj
Aliases: CVE-2017-5651 GHSA-9hg2-395j-83rm |
Information Exposure The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing completed quickly, it is possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up. |
Affected by 0 other vulnerabilities. |
|
VCID-gd2a-2tnw-aaap
Aliases: CVE-2017-5650 GHSA-9785-w233-x6hv |
Improper Resource Shutdown or Release The handling of an HTTP/2 `GOAWAY` frame for a connection did not close streams associated with that connection that were currently waiting for a `WINDOW_UPDATE` before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads. |
Affected by 0 other vulnerabilities. |
|
VCID-w4q7-4d2t-aaan
Aliases: CVE-2017-5647 GHSA-3gv7-3h64-78cm |
Information Exposure When "send file" is used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-11gb-2qp7-aaaj | Exposure of Resource to Wrong Sphere Some calls to application listeners in Apache Tomcat did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. |
CVE-2017-5648
GHSA-3vx3-xf6q-r5xp |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-03-28T13:19:19.926257+00:00 | Apache Tomcat Importer | Fixing | VCID-11gb-2qp7-aaaj | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:19.861960+00:00 | Apache Tomcat Importer | Affected by | VCID-w4q7-4d2t-aaan | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:19.802485+00:00 | Apache Tomcat Importer | Affected by | VCID-gd2a-2tnw-aaap | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:19.741538+00:00 | Apache Tomcat Importer | Affected by | VCID-3pmw-yhnf-aaaj | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2024-09-18T08:17:30.654671+00:00 | Apache Tomcat Importer | Fixing | VCID-11gb-2qp7-aaaj | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:30.602409+00:00 | Apache Tomcat Importer | Affected by | VCID-w4q7-4d2t-aaan | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:30.552810+00:00 | Apache Tomcat Importer | Affected by | VCID-gd2a-2tnw-aaap | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:30.494819+00:00 | Apache Tomcat Importer | Affected by | VCID-3pmw-yhnf-aaaj | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-01-04T02:15:34.786218+00:00 | Apache Tomcat Importer | Fixing | VCID-11gb-2qp7-aaaj | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:34.731143+00:00 | Apache Tomcat Importer | Affected by | VCID-w4q7-4d2t-aaan | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:34.677437+00:00 | Apache Tomcat Importer | Affected by | VCID-gd2a-2tnw-aaap | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:34.621843+00:00 | Apache Tomcat Importer | Affected by | VCID-3pmw-yhnf-aaaj | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |