Security Advisory WSO2-2017-0326

Published: December 19, 2017

Severity: Please refer[^1]


  • WSO2 API Manager 2.1.0
  • WSO2 App Manager 1.2.0
  • WSO2 Application Server 5.3.0
  • WSO2 Business Process Server 3.6.0
  • WSO2 Business Rules Server 2.2.0
  • WSO2 Complex Event Processor 4.2.0
  • WSO2 Dashboard Server 2.0.0
  • WSO2 Data Analytics Server 3.1.0
  • WSO2 Data Services Server 3.5.1
  • WSO2 Enterprise Integrator 6.1.1
  • WSO2 Governance Registry 5.4.0
  • WSO2 IoT Server 3.1.0
  • WSO2 Machine Learner 1.2.0
  • WSO2 Message Broker 3.2.0


Upgrade the embedded Apache Tomcat version of WSO2 products to 7.0.81 version, in order to support Tomcat-level security fixes.


With the Apache Tomcat upgrade, the following Common Vulnerability Exposure is fixed.

CVE-2017-12616: Information Disclosure


The WSO2 servers are exposed to known vulnerabilities of Apache Tomcat versions prior to 7.0.81.


Apply the following patches based on your product version by following the instructions in the README file. If you have any questions, post them to

Download the relevant patches based on the products you use following the matrix below. Patches can also be downloaded from Security Patch Releases.

Code Product Version Patch
AM WSO2 API Manager 2.1.0 WSO2-CARBON-PATCH-4.4.0-1664
APPM WSO2 App Manager 1.2.0 WSO2-CARBON-PATCH-4.4.0-1668
AS WSO2 Application Server 5.3.0 WSO2-CARBON-PATCH-4.4.0-1670
BPS WSO2 Business Process Server 3.6.0 WSO2-CARBON-PATCH-4.4.0-1668
BRS WSO2 Business Rules Server 2.2.0 WSO2-CARBON-PATCH-4.4.0-1670
CEP WSO2 Complex Event Processor 4.2.0 WSO2-CARBON-PATCH-4.4.0-1665
DS WSO2 Dashboard Server 2.0.0 WSO2-CARBON-PATCH-4.4.0-1670
DAS WSO2 Data Analytics Server 3.1.0 WSO2-CARBON-PATCH-4.4.0-1665
DSS WSO2 Data Services Server 3.5.1 WSO2-CARBON-PATCH-4.4.0-1665
EI WSO2 Enterprise Integrator 6.1.1 WSO2-CARBON-PATCH-4.4.0-1662
GREG WSO2 Governance Registry 5.4.0 WSO2-CARBON-PATCH-4.4.0-1654
IOT WSO2 IoT Server 3.1.0 WSO2-CARBON-PATCH-4.4.0-1663
MB WSO2 Message Broker 3.2.0 WSO2-CARBON-PATCH-4.4.0-1659
ML WSO2 Machine Learner 1.2.0 WSO2-CARBON-PATCH-4.4.0-1665


If you are using newer versions of the products than the ones mentioned in the "SOLUTION" section, this vulnerability is fixed. Please apply the relevant patches in the WSO2-2017-0255 security advisory as well, if you have not already applied.

The latest version of Apache Tomcat is 7.0.82 at the moment of this patch release, which addresses the CVE-2017-12617 reported on 7.0.81 version. However, WSO2 products are not affected by the reported vulnerabilities in the 7.0.81 version.