CVE-2017-7674
Fixed in a distro release EPSS 8%
The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat | 9.0.0.M22 |
| Maven | org.apache.tomcat:tomcat | 8.5.16 |
| Maven | org.apache.tomcat:tomcat | 8.0.45 |
| Maven | org.apache.tomcat:tomcat | 7.0.79 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 8 | tomcat7 | 7.0.56-3+really7.0.88-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u11 |
| Debian 9 | tomcat8 | 8.5.14-1+deb9u2 |
| Red Hat Enterprise Linux 7 | tomcat | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-admin-webapps | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-docs-webapp | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-el-2.2-api | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-javadoc | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-jsp-2.2-api | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-jsvc | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-lib | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-servlet-3.0-api | 0:7.0.76-3.el7_4 |
| Red Hat Enterprise Linux 7 | tomcat-webapps | 0:7.0.76-3.el7_4 |
| Red Hat jboss enterprise web server 3.1 | log4j-eap6 | 0:1.2.16-12.redhat_3.1.ep6.el7 |
| Red Hat jboss enterprise web server 3.1 | log4j-eap6 | 0:1.2.16-12.redhat_3.1.ep6.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native | 0:1.2.8-10.redhat_10.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native | 0:1.2.8-10.redhat_10.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native-debuginfo | 0:1.2.8-10.redhat_10.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native-debuginfo | 0:1.2.8-10.redhat_10.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7 | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7 | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-admin-webapps | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-admin-webapps | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-docs-webapp | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-docs-webapp | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-el-2.2-api | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-el-2.2-api | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-javadoc | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-javadoc | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsp-2.2-api | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsp-2.2-api | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsvc | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsvc | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-lib | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-lib | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-log4j | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-log4j | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-selinux | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-selinux | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-servlet-3.0-api | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-servlet-3.0-api | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-webapps | 0:7.0.70-22.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-webapps | 0:7.0.70-22.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8 | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8 | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-admin-webapps | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-admin-webapps | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-docs-webapp | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-docs-webapp | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-el-2.2-api | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-el-2.2-api | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-javadoc | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-javadoc | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsp-2.3-api | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsp-2.3-api | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsvc | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsvc | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-lib | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-lib | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-log4j | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-log4j | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-selinux | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-selinux | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-servlet-3.1-api | 0:8.0.36-24.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-servlet-3.1-api | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-webapps | 0:8.0.36-24.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-webapps | 0:8.0.36-24.ep7.el7 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | tomcat | 8.0.43-10.24.1 |
| SUSE Linux Enterprise Server 12 SP2 | tomcat | 8.0.43-29.5.1 |
| SUSE Linux Enterprise Server 12 SP3 | tomcat | 8.0.43-29.5.1 |
| SUSE Linux Enterprise Server 12-LTSS | tomcat | 7.0.82-7.16.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | tomcat | 8.0.43-29.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | tomcat | 8.0.43-10.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | tomcat | 8.0.43-29.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | tomcat | 8.0.43-29.5.1 |
| SUSE OpenStack Cloud 6 | tomcat | 8.0.43-10.24.1 |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.13 |
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.5 |
| Ubuntu Pro 16.04 LTS | tomcat7 | no fix |