CVE-2017-5664 in the critical feed json
Improper Handling of Exceptional Conditions in Apache Tomcat
published 2017-06-06 9 y ago modified 2026-10-15 24 d ago also GHSA-jmvv-524f-hj5j , EUVD-2022-4402
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 16.6%
- EPSS 16.6% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
Patch / fix
- maven org.apache.tomcat:tomcat 7.0.78, 8.0.44, 8.5.15, 9.0.0.M21
- tomcat7 Ubuntu 14.04 LTS 7.0.52-1ubuntu0.13
- tomcat8 Ubuntu 16.04 LTS 8.0.32-1ubuntu1.5
ubuntu advisories UBUNTU-CVE-2017-5664
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- jboss-ec2-eap jboss enterprise application platform 6 7.5.17-1.Final_redhat_4.ep6.el6
- jboss-ec2-eap-samples jboss enterprise application platform 6 7.5.17-1.Final_redhat_4.ep6.el6
- hornetq jboss enterprise application platform 6 2.3.25-22.SP20_redhat_1.1.ep6.el7
- jbossweb jboss enterprise application platform 6 7.5.24-1.Final_redhat_1.1.ep6.el7
- apache-cxf jboss enterprise application platform 6 2.7.18-7.SP6_redhat_1.1.ep6.el7
- infinispan jboss enterprise application platform 6 5.2.22-1.Final_redhat_1.1.ep6.el7
- jboss-vfs2 jboss enterprise application platform 6 3.2.12-1.Final_redhat_1.1.ep6.el7
- log4j-eap6 jboss enterprise web server 3.1, jboss enterprise application platform 6 1.2.16-12.redhat_3.1.ep6.el7
red hat advisories RHSA-2017:2638RHSA-2017:2636RHSA-2017:2637RHSA-2017:2635RHSA-2017:1801RHSA-2017:3080
- tomcat6 SLES for SAP 11 SP4, SLES 11 SP4 6.0.53-0.57.7.1
- tomcat SLES for SAP 12 SP1, SLES 12 SP1-LTSS, OpenStack Cloud 6 8.0.43-10.24.1
- tomcat SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +2 more 8.0.43-29.5.1
- tomcat SLES 12-LTSS 7.0.82-7.16.1
suse advisories SUSE-SU-2018:1847-1SUSE-SU-2017:3279-1SUSE-SU-2017:3059-1SUSE-SU-2017:3039-1
- tomcat openSUSE Tumbleweed 9.0.36-8.4
- tomcat10 openSUSE Tumbleweed 10.1.14-1.1
opensuse advisories openSUSE-SU-2024:11468-1openSUSE-SU-2024:13441-1
- github.com/apache/tomcat80@e070a31 commit
- github.com/apache/tomcat80@25d3c0d commit
- github.com/apache/tomcat@7d93527 commit
- github.com/apache/tomcat@58b3204 commit
- github.com/apache/tomcat@4545dcc commit
- github.com/apache/tomcat@3bfe9fb commit
- github.com/apache/tomcat@3242efe commit
- github.com/apache/tomcat@29893e6 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-5664 updated cvss 7.5
tomcat: Security constrained bypass in error page mechanism
-
Red Hat JBoss Enterprise Application Platform 5 jbossweb jbossweb Red Hat JBoss Fuse Service Works 6 jbossweb jbossweb Red Hat JBoss Operations Network 3 jbossweb jbosswebaffected: workaround, no fix planned “Will not fix”
-
Red Hat JBoss Portal 6 jbossweb jbosswebaffected: workaround, no fix available
-
Red Hat JBoss Fuse 6 tomcat7 tomcat7, tomcat8 tomcat8, jbossweb jbosswebunder investigation
-
Red Hat Enterprise Linux Client (v. 7) tomcat 7.0.69-12.el7_3, tomcat-servlet-3.0-api 7.0.69-12.el7_3 Red Hat Enterprise Linux Client Optional (v. 7) tomcat 7.0.69-12.el7_3, tomcat-lib 7.0.69-12.el7_3, tomcat-jsvc 7.0.69-12.el7_3, tomcat-javadoc 7.0.69-12.el7_3, tomcat-webapps 7.0.69-12.el7_3, tomcat-el-2.2-api 7.0.69-12.el7_3, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) tomcat 7.0.69-12.el7_3, tomcat-servlet-3.0-api 7.0.69-12.el7_3 Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat 7.0.69-12.el7_3, tomcat-lib 7.0.69-12.el7_3, tomcat-jsvc 7.0.69-12.el7_3, tomcat-javadoc 7.0.69-12.el7_3, tomcat-webapps 7.0.69-12.el7_3, tomcat-el-2.2-api 7.0.69-12.el7_3, +3 morefixed: vendor fix RHSA-2017:1809
-
Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6 6.0.24-111.el6_9, tomcat6-lib 6.0.24-111.el6_9, tomcat6-javadoc 6.0.24-111.el6_9, tomcat6-webapps 6.0.24-111.el6_9, tomcat6-el-2.1-api 6.0.24-111.el6_9, tomcat6-docs-webapp 6.0.24-111.el6_9, +3 more Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6 6.0.24-111.el6_9, tomcat6-lib 6.0.24-111.el6_9, tomcat6-javadoc 6.0.24-111.el6_9, tomcat6-webapps 6.0.24-111.el6_9, tomcat6-el-2.1-api 6.0.24-111.el6_9, tomcat6-docs-webapp 6.0.24-111.el6_9, +3 more Red Hat Enterprise Linux Server (v. 6) tomcat6 6.0.24-111.el6_9, tomcat6-lib 6.0.24-111.el6_9, tomcat6-el-2.1-api 6.0.24-111.el6_9, tomcat6-jsp-2.1-api 6.0.24-111.el6_9, tomcat6-servlet-2.5-api 6.0.24-111.el6_9fixed: vendor fix RHSA-2017:3080
-
Red Hat Enterprise Linux Server (v. 7) tomcat 7.0.69-12.el7_3, tomcat-lib 7.0.69-12.el7_3, tomcat-webapps 7.0.69-12.el7_3, tomcat-el-2.2-api 7.0.69-12.el7_3, tomcat-jsp-2.2-api 7.0.69-12.el7_3, tomcat-admin-webapps 7.0.69-12.el7_3, +1 morefixed: vendor fix RHSA-2017:1809
-
Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-javadoc 6.0.24-111.el6_9, tomcat6-webapps 6.0.24-111.el6_9, tomcat6-docs-webapp 6.0.24-111.el6_9, tomcat6-admin-webapps 6.0.24-111.el6_9fixed: vendor fix RHSA-2017:3080
-
Red Hat Enterprise Linux Server Optional (v. 7) tomcat 7.0.69-12.el7_3, tomcat-lib 7.0.69-12.el7_3, tomcat-jsvc 7.0.69-12.el7_3, tomcat-javadoc 7.0.69-12.el7_3, tomcat-webapps 7.0.69-12.el7_3, tomcat-el-2.2-api 7.0.69-12.el7_3, +3 morefixed: vendor fix RHSA-2017:1809
show 13 moreshow fewer
-
Red Hat Enterprise Linux Workstation (v. 6) tomcat6 6.0.24-111.el6_9, tomcat6-lib 6.0.24-111.el6_9, tomcat6-el-2.1-api 6.0.24-111.el6_9, tomcat6-jsp-2.1-api 6.0.24-111.el6_9, tomcat6-servlet-2.5-api 6.0.24-111.el6_9fixed: vendor fix RHSA-2017:3080
-
Red Hat Enterprise Linux Workstation (v. 7) tomcat 7.0.69-12.el7_3, tomcat-lib 7.0.69-12.el7_3, tomcat-webapps 7.0.69-12.el7_3, tomcat-el-2.2-api 7.0.69-12.el7_3, tomcat-jsp-2.2-api 7.0.69-12.el7_3, tomcat-admin-webapps 7.0.69-12.el7_3, +1 morefixed: vendor fix RHSA-2017:1809
-
Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-javadoc 6.0.24-111.el6_9, tomcat6-webapps 6.0.24-111.el6_9, tomcat6-docs-webapp 6.0.24-111.el6_9, tomcat6-admin-webapps 6.0.24-111.el6_9fixed: vendor fix RHSA-2017:3080
-
Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-jsvc 7.0.69-12.el7_3, tomcat-javadoc 7.0.69-12.el7_3, tomcat-docs-webapp 7.0.69-12.el7_3fixed: vendor fix RHSA-2017:1809
-
Red Hat JBoss Enterprise Application Platform 6.4fixed: vendor fix RHSA-2017:2633
-
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server log4j-eap6 1.2.16-12.redhat_3.1.ep6.el5, hornetq 2.3.25-22.SP20_redhat_1.1.ep6.el5, apache-cxf 2.7.18-7.SP6_redhat_1.1.ep6.el5, jbossweb 7.5.24-1.Final_redhat_1.1.ep6.el5, codehaus-jackson 1.9.9-11.redhat_5.1.ep6.el5, infinispan 5.2.22-1.Final_redhat_1.1.ep6.el5, +89 morefixed: vendor fix RHSA-2017:2637
-
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server log4j-eap6 1.2.16-12.redhat_3.1.ep6.el6, hornetq 2.3.25-22.SP20_redhat_1.1.ep6.el6, apache-cxf 2.7.18-7.SP6_redhat_1.1.ep6.el6, jbossweb 7.5.24-1.Final_redhat_1.1.ep6.el6, codehaus-jackson 1.9.9-11.redhat_5.1.ep6.el6, infinispan 5.2.22-1.Final_redhat_1.1.ep6.el6, +91 morefixed: vendor fix RHSA-2017:2635
-
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server log4j-eap6 1.2.16-12.redhat_3.1.ep6.el7, hornetq 2.3.25-22.SP20_redhat_1.1.ep6.el7, apache-cxf 2.7.18-7.SP6_redhat_1.1.ep6.el7, jbossweb 7.5.24-1.Final_redhat_1.1.ep6.el7, codehaus-jackson 1.9.9-11.redhat_5.1.ep6.el7, infinispan 5.2.22-1.Final_redhat_1.1.ep6.el7, +89 morefixed: vendor fix RHSA-2017:2636
-
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat6 6.0.41-17_patch_04.ep6.el6, tomcat7 7.0.54-25_patch_05.ep6.el6, tomcat6-lib 6.0.41-17_patch_04.ep6.el6, tomcat7-lib 7.0.54-25_patch_05.ep6.el6, jbcs-httpd24-openssl 1.0.2h-13.jbcs.el6, tomcat6-log4j 6.0.41-17_patch_04.ep6.el6, +17 more Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server tomcat6 6.0.41-17_patch_04.ep6.el7, tomcat7 7.0.54-25_patch_05.ep6.el7, tomcat6-lib 6.0.41-17_patch_04.ep6.el7, tomcat7-lib 7.0.54-25_patch_05.ep6.el7, jbcs-httpd24-openssl 1.0.2h-13.jbcs.el7, tomcat6-log4j 6.0.41-17_patch_04.ep6.el7, +17 morefixed: vendor fix RHSA-2017:2493
-
Red Hat JBoss Web Server 2.1fixed: vendor fix RHSA-2017:2494
-
Red Hat JBoss Web Server 3.1fixed: vendor fix RHSA-2017:1802
-
Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat7 7.0.70-22.ep7.el6, tomcat8 8.0.36-24.ep7.el6, tomcat7-lib 7.0.70-22.ep7.el6, tomcat8-lib 8.0.36-24.ep7.el6, tomcat7-jsvc 7.0.70-22.ep7.el6, tomcat8-jsvc 8.0.36-24.ep7.el6, +20 more Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat7 7.0.70-22.ep7.el7, tomcat8 8.0.36-24.ep7.el7, tomcat7-lib 7.0.70-22.ep7.el7, tomcat8-lib 8.0.36-24.ep7.el7, tomcat7-jsvc 7.0.70-22.ep7.el7, tomcat8-jsvc 8.0.36-24.ep7.el7, +20 morefixed: vendor fix RHSA-2017:1801
-
Red Hat JBoss Data Grid 6 jbossweb jbossweb Red Hat JBoss Data Virtualization 6 jbossweb jbossweb Red Hat Software Collections rh-java-common-tomcat-lib, rh-java-common-tomcat-javadoc, rh-java-common-tomcat-el-2.2-api, rh-java-common-tomcat-jsp-2.2-api, rh-java-common-tomcat-servlet-3.0-apinot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 24 d ago
Exploit prediction
16.57% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | >=9.0.0.M1, <9.0.0.M21 >=8.5.0, <8.5.15 >=8.0.0, <8.0.44 >=7.0.0, <7.0.78 |
9.0.0.M21 8.5.15 8.0.44 7.0.78 |
Affected products
- Apache Software Foundation Apache Tomcat
Classification
- Weakness
-
- CWE-755 Improper Handling of Exceptional Conditions
References
-
github.com
/apache/tomcat80/commit/e070a31ec81b56377822e44883c64abb41f36a3b
web
-
github.com
/apache/tomcat80/commit/25d3c0d93190ef165ecd6c744bc15b5059abfa8f
web
-
github.com
/apache/tomcat/commit/7d93527254d9e9371b342800617f20d13c8b85ad
web
-
github.com
/apache/tomcat/commit/58b32048ce25cb812ae394dafb0cd57254c68155
web
-
github.com
/apache/tomcat/commit/4545dcce444aa619374a659cb450dbbd0be3c921
web
-
github.com
/apache/tomcat/commit/3bfe9fb886598c4d8ecbe674216152006bbce456
web
-
github.com
/apache/tomcat/commit/3242efea525df01d15da6e90ea69a9a21b10b454
web
-
github.com
/apache/tomcat/commit/29893e66111d33cfe99dd01cb146317c0c262ef4
web
-
debian.org
/security/2017/dsa-3891
vendor-advisory
-
access.redhat.com
/errata/RHSA-2017:3080
vendor-advisory
-
access.redhat.com
/errata/RHSA-2017:1801
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2017:2635
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2017:2638
vendor-advisory
-
access.redhat.com
/errata/RHSA-2017:2494
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2017:2636
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2017:1809
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2017:2637
vendor-advisory
-
debian.org
/security/2017/dsa-3892
vendor-advisory
-
access.redhat.com
/errata/RHSA-2017:2633
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2017:1802
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2017:2493
vendor-advisory, web
- security.netapp.com /advisory/ntap-20171019-0002/
-
securityfocus.com
/bid/98888
vdb-entry, third-party-advisory
- oracle.com /technetwork/security-advisory/cpujul2018-4258247.html
- oracle.com /technetwork/security-advisory/cpujan2018-3236628.html
-
support.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us
web
- oracle.com /technetwork/security-advisory/cpuoct2017-3236626.html
- oracle.com /technetwork/security-advisory/cpuapr2018-3678067.html
-
lists.apache.org
/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E
mailing-list, web
-
securitytracker.com
/id/1038641
vdb-entry
-
lists.apache.org
/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
mailing-list
-
oracle.com
/technetwork/security-advisory/cpuapr2019-5072813.html
web
-
oracle.com
/technetwork/security-advisory/cpujul2019-5072835.html
web
-
lists.apache.org
/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2017-5664
advisory
-
lists.apache.org
/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066@%3Cannounce.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
web
-
security.netapp.com
/advisory/ntap-20171019-0002
web
-
web.archive.org
/web/20170801120345/http://www.securitytracker.com/id/1038641
web
-
web.archive.org
/web/20170805032345/http://www.securityfocus.com/bid/98888
web
Sources
- CVE List CVE-2017-5664
- GitHub Advisory GHSA-jmvv-524f-hj5j
- NVD CVE-2017-5664
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.