CVE-2017-5651

Name	CVE-2017-5651
Description	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs	860071

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tomcat8 (PTS)	stretch	8.5.54-0+deb9u1	fixed
	stretch (security)	8.5.54-0+deb9u8	fixed
tomcat9 (PTS)	buster, buster (security)	9.0.31-1~deb10u6	fixed
	bullseye (security), bullseye	9.0.43-2~deb11u3	fixed
	bookworm, sid	9.0.64-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
tomcat8	source	jessie	(not affected)
tomcat8	source	(unstable)	8.5.11-2	860071
tomcat9	source	(unstable)	(not affected)

Notes

- tomcat9 <not-affected> (Fixed before initial upload to Debian)
[jessie] - tomcat8 <not-affected> (Only affects 8.5 and later)
https://www.openwall.com/lists/oss-security/2017/04/10/21
Fixed by: http://svn.apache.org/r1788546 (8.5.x)