CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
82.7%
Issue Overview:
Security constrained bypass in error page mechanism:
A vulnerability was discovered in the error page mechanism in Tomcat’s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)
Affected Packages:
tomcat7
Issue Correction:
Run yum update tomcat7 to update your system.
New Packages:
noarch:
tomcat7-webapps-7.0.78-1.27.amzn1.noarch
tomcat7-lib-7.0.78-1.27.amzn1.noarch
tomcat7-javadoc-7.0.78-1.27.amzn1.noarch
tomcat7-log4j-7.0.78-1.27.amzn1.noarch
tomcat7-docs-webapp-7.0.78-1.27.amzn1.noarch
tomcat7-jsp-2.2-api-7.0.78-1.27.amzn1.noarch
tomcat7-servlet-3.0-api-7.0.78-1.27.amzn1.noarch
tomcat7-7.0.78-1.27.amzn1.noarch
tomcat7-admin-webapps-7.0.78-1.27.amzn1.noarch
tomcat7-el-2.2-api-7.0.78-1.27.amzn1.noarch
src:
tomcat7-7.0.78-1.27.amzn1.src
Red Hat: CVE-2017-5664
Mitre: CVE-2017-5664
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
82.7%