When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-lib | Nov 16, 2023 | Mar 22, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-3.1-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvc | May 3, 2023 | Mar 22, 2023 |
| Amazon_linux | — | amazon-linux-upgrade-tomcat8 | Apr 21, 2023 | Mar 22, 2023 |
| Apache Tomcat | apache-tomcat-upgrade-8_5_86apache-tomcat-upgrade-9_0_72apache-tomcat-upgrade-10_1_6apache-tomcat-upgrade-11_0_0apache-tomcat-upgrade-latest | Mar 23, 2023 | Mar 22, 2023 | |
| Centos_linux | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-lib | Nov 8, 2023 | Mar 22, 2023 |
| Debian | — | Upgrade tomcat9Upgrade tomcat10 | Apr 10, 2023 | Mar 22, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade phpUpgrade php-recodeUpgrade php-xmlUpgrade php-cliUpgrade php-ldapUpgrade php-gdUpgrade php-soapUpgrade php-commonUpgrade php-pdoUpgrade php-processUpgrade php-fpmUpgrade php-odbcUpgrade php-xmlrpc | Jun 9, 2023 | Mar 22, 2023 |
| Oracle_linux | — | oracle-linux-upgrade-tomcatoracle-linux-upgrade-tomcat-admin-webappsoracle-linux-upgrade-tomcat-docs-webapporacle-linux-upgrade-tomcat-el-3-0-apioracle-linux-upgrade-tomcat-jsp-2-3-apioracle-linux-upgrade-tomcat-liboracle-linux-upgrade-tomcat-servlet-4-0-apioracle-linux-upgrade-tomcat-webapps | Nov 16, 2023 | Mar 22, 2023 |
| Redhat_linux | — | Upgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-el-3.0-apiNo solution existsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webapps | Nov 8, 2023 | Mar 22, 2023 |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Mar 30, 2023 | Mar 22, 2023 |
| Ubuntu | ubuntu-pro-upgrade-libtomcat10-javaubuntu-pro-upgrade-libtomcat8-javaubuntu-pro-upgrade-libtomcat9-javaubuntu-pro-upgrade-tomcat10ubuntu-pro-upgrade-tomcat8ubuntu-pro-upgrade-tomcat9ubuntu-upgrade-libtomcat9-javaubuntu-upgrade-tomcat9 | Nov 19, 2024 | Mar 22, 2023 | |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub