Not rated
CVE-2017-7674 The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did…
Description
The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Tomcat | Versions not published |
References
- support.hpe.com support.hpe.com
- RHSA-2017:1801 access.redhat.com
- [announce] 20170810 [SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning lists.apache.org
- security.netapp.com security.netapp.com
- 100280 www.securityfocus.com
- DSA-3974 www.debian.org
- www.oracle.com www.oracle.com
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update lists.debian.org
- RHSA-2017:1802 access.redhat.com
- RHSA-2017:3081 access.redhat.com
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context lists.apache.org
- [tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Tomcat
The 141 CVEs of Apache Tomcat →
CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body…
Not rated
CVE-2026-101356
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…
Not rated
CVE-2026-101296
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with…
Not rated
CVE-2026-93446
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently
Not rated