MGASA-2017-0400

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2017-12617
Published: 02 Nov 2017, 21:47
Last modified:16 Apr 2026, 06:26

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Nov 2017, 21:47
Published
Vulnerability first disclosed
16 Apr 2026, 06:26
Last Modified
Vulnerability information updated

Description

Updated tomcat packages fix security vulnerability When running with HTTP PUTs enabled (e.g. via setting the readonly initialization parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server (CVE-2017-12617).

Affected Systems

  • mageia•tomcat

    < 7.0.82-1.mga5

  • mageia•tomcat

    < 8.0.47-1.mga6

References (4)