Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
Summary
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
Original description
The description as published by the source.
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-28708 tomcat10 Fixed in: 10.1.6-1
- Ubuntu UBUNTU-CVE-2023-28708 tomcat6
References
- advisory lists.apache.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com