Most recent entries from all

ALSA-2023:6570 — Moderate: tomcat security and bug fix update

Affected: AlmaLinux:9: tomcat, AlmaLinux:9: tomcat-admin-webapps, AlmaLinux:9: tomcat-docs-webapp, AlmaLinux:9: tomcat-el-3.0-api, AlmaLinux:9: tomcat-jsp-2.3-api, AlmaLinux:9: tomcat-lib, AlmaLinux:9: tomcat-servlet-4.0-api, AlmaLinux:9: tomcat-webapps

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998) * tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708) * tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2025-10838

BIT-tomcat-2023-28708 — Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

Affected: Bitnami: tomcat

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 10.1.0 to 10.1.5, 9.0.0 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Older, EOL versions may also be affected.

certfr-2023-avi-0253 — Une vulnérabilité a été découverte dans Apache Tomcat. Elle permet à un attaquant de provoquer une atteinte à la confid…

certfr-2023-avi-0253

Withdrawn: CLEANSTART-2026-AJ47488 — When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Prot…

Withdrawn by the publisher.

Affected: CleanStart: tomcat10

Multiple security vulnerabilities affect the tomcat10 package. When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11. See references for individual vulnerability details.

EUVD-2026-259638

fkie_cve-2023-28708

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Older, EOL versions may also be affected.

GHSA-2c9m-w27f-53rm — Apache Tomcat vulnerable to Unprotected Transport of Credentials

Affected: Maven: org.apache.tomcat:tomcat-catalina

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

gsd-2023-28708

OESA-2023-1247 — tomcat security update

Affected: openEuler:20.03-LTS-SP1: tomcat, openEuler:20.03-LTS-SP3: tomcat, openEuler:22.03-LTS: tomcat, openEuler:22.03-LTS-SP1: tomcat

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project Security Fix(es): When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.(CVE-2023-28708)

openSUSE-SU-2024:12821-1 — tomcat-9.0.43-15.1 on GA media

tomcat-9.0.43-15.1 on GA media

RHSA-2023:4909 — Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update

apr: integer overflow/wraparound in apr_encode FileUpload: FileUpload DoS with excessive parts tomcat: not including the secure attribute causes information disclosure tomcat: Fix for CVE-2023-24998 was incomplete

SUSE-SU-2023:1669-1 — Security update for tomcat

Security update for tomcat

UBUNTU-CVE-2023-28708

Affected: Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:Pro:24.04:LTS: tomcat9, Ubuntu:25.10: tomcat9

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.

WID-SEC-W-2023-0717 — Apache Tomcat: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um Informationen offenzulegen.