CVE-2017-12617
CVE-2017-12617
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVSS 8.1 · Alta · EPSS 100,0% · En el catálogo KEV · Código de explotación público · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
apache tomcat
- Versiones
- 9.0.0.M1 to 9.0.0: Afectada
- 8.5.0 to 8.5.22: Afectada
- 8.0.0.RC1 to 8.0.46: Afectada
- 7.0.0 to 7.0.81: Afectada
Sin corrección publicada
tomcat7 Ubuntu:14.04:LTS
- Versiones
- 7.0.42-1
- 7.0.47-1
- 7.0.50-1
- 7.0.52-1
- 7.0.52-1ubuntu0.1
- 7.0.52-1ubuntu0.3
- 7.0.52-1ubuntu0.6
- 7.0.52-1ubuntu0.7
- 7.0.52-1ubuntu0.8
- 7.0.52-1ubuntu0.9
- 7.0.52-1ubuntu0.10
- 7.0.52-1ubuntu0.11
- 7.0.52-1ubuntu0.13
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.0.52-1ubuntu0.14
Actualiza a 7.0.52-1ubuntu0.14
tomcat8 Ubuntu:16.04:LTS
- Versiones
- 8.0.26-1
- 8.0.28-1
- 8.0.30-1
- 8.0.32-1
- 8.0.32-1ubuntu1
- 8.0.32-1ubuntu1.1
- 8.0.32-1ubuntu1.2
- 8.0.32-1ubuntu1.3
- 8.0.32-1ubuntu1.4
- 8.0.32-1ubuntu1.5
- Intervalos de versiones afectados
- ECOSYSTEM: < 8.0.32-1ubuntu1.6
Actualiza a 8.0.32-1ubuntu1.6
tomcat7 Ubuntu:Pro:16.04:LTS
- Versiones
- 7.0.64-1
- 7.0.68-1
- 7.0.68-1ubuntu0.1
- 7.0.68-1ubuntu0.3
- 7.0.68-1ubuntu0.4
- 7.0.68-1ubuntu0.4+esm1
- 7.0.68-1ubuntu0.4+esm2
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.0.68-1ubuntu0.4+esm3
Actualiza a 7.0.68-1ubuntu0.4+esm3
tomcat7 Ubuntu:Pro:18.04:LTS
- Versiones
- 7.0.78-1
- 7.0.78-1ubuntu0.1~esm1
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
Fuentes originales
- https://access.redhat.com/errata/RHSA-2017:3113
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://access.redhat.com/errata/RHSA-2017:3080
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us
- https://access.redhat.com/errata/RHSA-2018:0269
- https://www.exploit-db.com/exploits/42966/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us
- https://access.redhat.com/errata/RHSA-2018:0270
- https://access.redhat.com/errata/RHSA-2018:0271
- https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html
- https://access.redhat.com/errata/RHSA-2018:2939
- https://access.redhat.com/errata/RHSA-2018:0465
- https://usn.ubuntu.com/3665-1/
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- https://access.redhat.com/errata/RHSA-2018:0268
- https://access.redhat.com/errata/RHSA-2017:3114
- https://www.exploit-db.com/exploits/43008/
- http://www.securitytracker.com/id/1039552
- http://www.securityfocus.com/bid/100954
- https://access.redhat.com/errata/RHSA-2018:0275
- https://access.redhat.com/errata/RHSA-2018:0466
- https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2017-12617