CVE-2017-15706 Apache Tomcat Incorrectly documented CGI search algorithm Severity: Low
Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M22 to 9.0.1 Apache Tomcat 8.5.16 to 8.5.23 Apache Tomcat 8.0.45 to 8.0.47 Apache Tomcat 7.0.79 to 7.0.82 Description: As part of the fix for bug 61201, the description of the search algorithm used by the CGI Servlet to identify which script to execute was updated. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected. Mitigation: Users of the affected versions should review the CGI documentation from one of the following versions and ensure that the described CGI search algorithm matches their expectation: - Apache Tomcat 9.0.2 or later - Apache Tomcat 8.5.24 or later - Apache Tomcat 8.0.48 or later - Apache Tomcat 7.0.84 or later (Apache Tomcat 7.0.83 has the fix but was not released) Credit: This issue was reported responsibly to the Apache Tomcat Security Team by Michael Grenier. History: 2018-01-31 Original advisory References: [1] http://tomcat.apache.org/security-9.html [2] http://tomcat.apache.org/security-8.html [3] http://tomcat.apache.org/security-7.html --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
