// For flags

CVE-2017-5650

Gentoo Linux Security Advisory 201705-09

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

En Apache Tomcat 9.0.0.M1 a 9.0.0.M18 y 8.5.0 a 8.5.12, el tratamiento de un marco HTTP/2 GOAWAY para una conexión que no cerró los flujos asociados con esa conexión que estaban esperando actualmente un WINDOW_UPDATE antes de permitir que la aplicación escriba más datos. Estos flujos de espera cada uno consumió un hilo. Un cliente malicioso podría construir una serie de peticiones HTTP/2 que consumirían todos los subprocesos de procesamiento disponibles.

Multiple vulnerabilities have been found in Apache Tomcat, the worst of which could lead to privilege escalation. Versions less than 8.0.36 are affected.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-01-29 CVE Reserved
  • 2017-04-17 CVE Published
  • 2024-08-05 CVE Updated
  • 2025-07-01 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-404: Improper Resource Shutdown or Release
CAPEC
References (13)
URL Tag Source
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html X_refsource_confirm
http://www.securityfocus.com/bid/97531 Third Party Advisory
http://www.securitytracker.com/id/1038217 Vdb Entry
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/d24303fb095db072740d8154b0f0db3f2b8f67bc91a0562dbe89c738%40%3Cannounce.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E Mailing List
https://security.netapp.com/advisory/ntap-20180614-0001 X_refsource_confirm
URL Date SRC
URL Date SRC
URL Date SRC
https://security.gentoo.org/glsa/201705-09 2023-12-08
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.0
Search vendor "Apache" for product "Tomcat" and version "8.5.0"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.1
Search vendor "Apache" for product "Tomcat" and version "8.5.1"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.2
Search vendor "Apache" for product "Tomcat" and version "8.5.2"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.3
Search vendor "Apache" for product "Tomcat" and version "8.5.3"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.4
Search vendor "Apache" for product "Tomcat" and version "8.5.4"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.5
Search vendor "Apache" for product "Tomcat" and version "8.5.5"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.6
Search vendor "Apache" for product "Tomcat" and version "8.5.6"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.7
Search vendor "Apache" for product "Tomcat" and version "8.5.7"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.8
Search vendor "Apache" for product "Tomcat" and version "8.5.8"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.9
Search vendor "Apache" for product "Tomcat" and version "8.5.9"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.10
Search vendor "Apache" for product "Tomcat" and version "8.5.10"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.11
Search vendor "Apache" for product "Tomcat" and version "8.5.11"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 8.5.12
Search vendor "Apache" for product "Tomcat" and version "8.5.12"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone1
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone10
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone11
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone12
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone13
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone14
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone15
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone16
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone17
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone18
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone2
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone3
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone4
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone5
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone6
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone7
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone8
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 9.0.0
Search vendor "Apache" for product "Tomcat" and version "9.0.0"
milestone9
Affected