On 20/04/2017 17:14, Durga Srinivasu Karuturi wrote:
> Hi,
>
> We are trying to analyze two of the below CVEs related to tomcat sendfile
> feature.
>
> CVE-2017-5647 (Production tomcat 8.0.26)
> CVE-2017-5651(Current tomcat 8.5.12)
>
> We are enabling compression with NIO connector.
>
> As per docs, connector level by default sendfile is enabled and sendfile
> takes precedence over compression.
>
> We are not setting any request attribute "org.apache.tomcat.sendfile.support"
> to enable this support also.
>
> With this can we assume sendfile will not be used and these two CVEs are
> not application for us.
No.
> Or Do we need to disable connector level to completed turnoff sendfile?
>
> Please clarify.
send file will still be used for static content unless send file is
disabled on the connector.
Mark
-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
