Fixed in Apache Tomcat 8.5.86

Important: Apache Tomcat information disclosure CVE-2023-28708 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Tomcat did not include the secure attribute. This could result in th...

KLA48635 OSI vulnerability in Apache Tomcat

Information disclosure vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories Fixed in Apache Tomcat 8.5.86 Fixed in Apache Tomcat 10.1.6 Related products Apache-Tomcat CVE list CVE-2023-28708 warning Solution...

Fixed in Apache Tomcat 10.1.6

Important: Apache Tomcat information disclosure CVE-2023-28708 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Tomcat did not include the secure attribute. This could result in th...

PT-2023-21918

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M2 Apache Tomcat versions 10.1.0-M1 through 10.1.5 Apache Tomcat versions 9.0.0-M1 through 9.0.71 Apache Tomcat versions 8.5.0 through 8.5.85 Description When using the RemoteIpFilter with reques...

Fixed in Apache Tomcat 11.0.0-M3

Important: Apache Tomcat information disclosure CVE-2023-28708 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Tomcat did not include the secure attribute. This could result in th...

Fixed in Apache Tomcat 9.0.72

Important: Apache Tomcat information disclosure CVE-2023-28708 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Tomcat did not include the secure attribute. This could result in th...

KLA48634 OSI vulnerability in Apache Tomcat

Information disclosure vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories Fixed in Apache Tomcat 9.0.72 Related products Apache-Tomcat CVE list CVE-2023-28708 warning Solution Update to the latest version...

Apache Tomcat 8.5.x < 8.5.85 Denial Of Service

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.85, 9.0.0-M1 prior to 9.0.71, 10.1.0-M1 prior to 10.1.5 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by a denial of service due to a vulnerability in the file upload functionality in the Apache Commons...

Apache Tomcat 9.0.0-M1 < 9.0.71 Denial Of Service

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.85, 9.0.0-M1 prior to 9.0.71, 10.1.0-M1 prior to 10.1.5 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by a denial of service due to a vulnerability in the file upload functionality in the Apache Commons...

Apache Tomcat 11.0.0-M1 < 11.0.0-M3 Denial Of Service

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.85, 9.0.0-M1 prior to 9.0.71, 10.1.0-M1 prior to 10.1.5 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by a denial of service due to a vulnerability in the file upload functionality in the Apache Commons...

Apache Tomcat 10.1.0-M1 < 10.1.5 Denial Of Service

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.85, 9.0.0-M1 prior to 9.0.71, 10.1.0-M1 prior to 10.1.5 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by a denial of service due to a vulnerability in the file upload functionality in the Apache Commons...

CVE-2023-24998

A flaw was found in Apache Commons FileUpload, where it does not limit the number of parts being processed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to trigger a denial of service. While Red Hat Satellite relies upon Apache Tomcat, it does not...

K51663510: Apache Tomcat vulnerability CVE-2016-5388

Security Advisory Description Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect ...

K38110373: Apache Tomcat vulnerability CVE-2014-7810

Security Advisory Description The Expression Language EL implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a...

K20224417: OCSP responder vulnerability CVE-2018-8019

Security Advisory Description When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with...

K01225001: Apache Tomcat vulnerability CVE-2017-5664

Security Advisory Description The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to...

K37337112: Apache Tomcat vulnerability CVE-2017-6056

Security Advisory Description It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816...

K11420556: Apache Tomcat vulnerability CVE-2018-8014

Security Advisory Description The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have...

K38108582: Apache Tomcat vulnerability CVE-2018-11759

Security Advisory Description The Apache Web Server httpd specific code that normalized the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were...

K20038622: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2013-1976 The 1 tomcat5, 2 tomcat6, and 3 tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a...