When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-lib | Nov 16, 2023 | Mar 22, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-jsvc | May 3, 2023 | Mar 22, 2023 |
| Amazon_linux | — | Upgrade tomcat8 | Apr 21, 2023 | Mar 22, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.72Upgrade Apache Tomcat to 8.5.86Upgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 10.1.6 | Mar 23, 2023 | Mar 22, 2023 |
| Centos_linux | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-lib | Nov 8, 2023 | Mar 22, 2023 |
| Debian | — | Upgrade tomcat10Upgrade tomcat9 | Apr 10, 2023 | Mar 22, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-gdUpgrade phpUpgrade php-ldapUpgrade php-recodeUpgrade php-xmlUpgrade php-cliUpgrade php-commonUpgrade php-soapUpgrade php-odbcUpgrade php-processUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-fpm | Jun 9, 2023 | Mar 22, 2023 |
| Oracle_linux | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat | Nov 16, 2023 | Mar 22, 2023 |
| Redhat_linux | — | Upgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-webappsNo solution existsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-api | Nov 8, 2023 | Mar 22, 2023 |
| Suse | — | Upgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-embedUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-docs-webapp | Mar 30, 2023 | Mar 22, 2023 |
| Ubuntu | — | Upgrade tomcat9Upgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat8 (Ubuntu Pro)Upgrade tomcat10 (Ubuntu Pro)Upgrade libtomcat9-javaUpgrade libtomcat8-java (Ubuntu Pro)Upgrade libtomcat10-java (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro) | Nov 19, 2024 | Mar 22, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 22, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub