CVE-2017-5651

Name	CVE-2017-5651
Description	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	high (attack range: remote)
Debian Bugs	802312, 860071

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tomcat8 (PTS)	jessie	8.0.14-1+deb8u11	fixed
	jessie (security)	8.0.14-1+deb8u14	fixed
	stretch	8.5.14-1+deb9u2	fixed
	stretch (security)	8.5.14-1+deb9u3	fixed
	buster, sid	8.5.34-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
tomcat8	source	(unstable)	8.5.11-2	high	860071
tomcat8	source	jessie	(not affected)
tomcat9	ITP				802312

Notes

[jessie] - tomcat8 <not-affected> (Only affects 8.5 and later)
http://www.openwall.com/lists/oss-security/2017/04/10/21
Fixed by: http://svn.apache.org/r1788546 (8.5.x)