The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 6.0.9Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 5.5.21Upgrade Apache Tomcat to 4.1.39 | May 17, 2012 | Jan 23, 2008 |
| Suse | — | Upgrade apache2-jakarta-tomcat-connectorsUpgrade jakarta-tomcat-docUpgrade tomcat5Upgrade tomcat5-admin-webappsUpgrade jakarta-tomcatUpgrade suse-releaseUpgrade apache2-mod_jkUpgrade tomcat5-webappsUpgrade jakarta-tomcat-examplesUpgrade apache-jakarta-tomcat-connectors | Feb 17, 2015 | Jan 22, 2008 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub