The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-lib | Nov 16, 2023 | Mar 22, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-docs-webapp | May 3, 2023 | Mar 22, 2023 |
| Amazon_linux | — | Upgrade tomcat8 | Apr 21, 2023 | Mar 22, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 10.1.6Upgrade Apache Tomcat to 9.0.72Upgrade Apache Tomcat to 8.5.86 | Mar 23, 2023 | Mar 22, 2023 |
| Centos_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-api | Nov 8, 2023 | Mar 22, 2023 |
| Debian | — | Upgrade tomcat9Upgrade tomcat10 | Apr 10, 2023 | Mar 22, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-fpmUpgrade php-pdoUpgrade php-commonUpgrade php-soapUpgrade php-odbcUpgrade php-xmlrpcUpgrade php-processUpgrade php-xmlUpgrade php-gdUpgrade php-recodeUpgrade php-cliUpgrade php-ldapUpgrade php | Jun 9, 2023 | Mar 22, 2023 |
| Oracle_linux | — | Upgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-api | Nov 16, 2023 | Mar 22, 2023 |
| Redhat_linux | — | Upgrade tomcat-libNo solution existsUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-docs-webapp | Nov 8, 2023 | Mar 22, 2023 |
| Suse | — | Upgrade tomcat-el-3_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-embedUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-servlet-4_0-api | Mar 30, 2023 | Mar 22, 2023 |
| Ubuntu | — | Upgrade libtomcat8-java (Ubuntu Pro)Upgrade libtomcat10-java (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro)Upgrade libtomcat9-javaUpgrade tomcat10 (Ubuntu Pro)Upgrade tomcat8 (Ubuntu Pro)Upgrade tomcat9Upgrade libtomcat9-java (Ubuntu Pro) | Nov 19, 2024 | Mar 22, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 22, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub