CVE-2017-7675

2017-08-1102:29:00

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

54.9%

JSON

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.

OSVersionArchitecturePackageVersionFilename
Debian12alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb
Debian11alltomcat9< 9.0.43-2~deb11u10tomcat9_9.0.43-2~deb11u10_all.deb
Debian999alltomcat9< 9.0.95-1tomcat9_9.0.95-1_all.deb
Debian13alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb
Debian	11	all	tomcat9	< 9.0.43-2~deb11u10	tomcat9_9.0.43-2~deb11u10_all.deb
Debian	999	all	tomcat9	< 9.0.95-1	tomcat9_9.0.95-1_all.deb
Debian	13	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb