Is Spectrum affected by the following Apache Tomcat vulnerabilities?

Document ID : KB000014455
Last Modified Date : 14/02/2018
Show Technical Document Details
Introduction:

There are the following Apache Tomcat vulnerabilities reported, i.e.

  • CVE-2017-5651
    In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
  • CVE-2017-5647
    A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
  • CVE-2017-5650
    In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

  • CVE-2017-5648
    While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.

  • CVE-2016-6808
    Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
Question:

Are Spectrum 10.2 or Spectrum 10.2.1 affected by these Apache Tomcat vulnerabilities?

Environment:
Spectrum 10.2, 10.2.1
Answer:

Spectrum 10.2, 10.2.1 are using Apache Tomcat 7.0.72. Below vulnerabilities don't affect Tomcat 7.0.72, thus Spectrum is not affected.

  • CVE-2017-5651
  • CVE-2017-5650

Spectrum Engineering has also confirmed that Spectrum is not affected by the following vulnerabilities.

  • CVE-2016-6808
  • CVE-2017-5647 

However Spectrum is affected by CVE-2017-5648 vulnerability. We are tracking this issue internally in ticket US341923, and plan to address this issue in our next release Spectrum, i.e. Spectrum 10.3

Additional Information:

http://tomcat.apache.org/security-7.html