Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
Résumé
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
Description d'origine
La description telle que publiée par la source (souvent en anglais).
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-28708 tomcat10 Corrigé dans: 10.1.6-1
- Ubuntu UBUNTU-CVE-2023-28708 tomcat6
Références
- advisory lists.apache.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com