CVE-2023-28708
Fixed in a distro release EPSS 2%CVSS 4.3
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat-catalina | 11.0.0-M3 |
| Maven | org.apache.tomcat:tomcat-catalina | 10.1.6 |
| Maven | org.apache.tomcat:tomcat-catalina | 9.0.72 |
| Maven | org.apache.tomcat:tomcat-catalina | 8.5.86 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:8 | tomcat | 1:9.0.62-27.el8_9 |
| AlmaLinux:8 | tomcat-admin-webapps | 1:9.0.62-27.el8_9 |
| AlmaLinux:8 | tomcat-docs-webapp | 1:9.0.62-27.el8_9 |
| AlmaLinux:8 | tomcat-el-3.0-api | 1:9.0.62-27.el8_9 |
| AlmaLinux:8 | tomcat-jsp-2.3-api | 1:9.0.62-27.el8_9 |
| AlmaLinux:8 | tomcat-lib | 1:9.0.62-27.el8_9 |
| AlmaLinux:8 | tomcat-servlet-4.0-api | 1:9.0.62-27.el8_9 |
| AlmaLinux:8 | tomcat-webapps | 1:9.0.62-27.el8_9 |
| AlmaLinux:9 | tomcat | 1:9.0.62-37.el9_3 |
| AlmaLinux:9 | tomcat-admin-webapps | 1:9.0.62-37.el9_3 |
| AlmaLinux:9 | tomcat-docs-webapp | 1:9.0.62-37.el9_3 |
| AlmaLinux:9 | tomcat-el-3.0-api | 1:9.0.62-37.el9_3 |
| AlmaLinux:9 | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3 |
| AlmaLinux:9 | tomcat-lib | 1:9.0.62-37.el9_3 |
| AlmaLinux:9 | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3 |
| AlmaLinux:9 | tomcat-webapps | 1:9.0.62-37.el9_3 |
| Debian:10 | tomcat9 | 9.0.31-1~deb10u8 |
| Debian:11 | tomcat9 | 9.0.43-2~deb11u6 |
| Debian:12 | tomcat10 | 10.1.6-1 |
| Debian:12 | tomcat9 | 9.0.70-2 |
| Debian:13 | tomcat10 | 10.1.6-1 |
| Debian:13 | tomcat9 | 9.0.70-2 |
| Debian:14 | tomcat10 | 10.1.6-1 |
| Debian:14 | tomcat9 | 9.0.70-2 |
| Red Hat:enterprise_linux:8 | tomcat | 1:9.0.62-27.el8_9 |
| Red Hat:enterprise_linux:8 | tomcat-admin-webapps | 1:9.0.62-27.el8_9 |
| Red Hat:enterprise_linux:8 | tomcat-docs-webapp | 1:9.0.62-27.el8_9 |
| Red Hat:enterprise_linux:8 | tomcat-el-3.0-api | 1:9.0.62-27.el8_9 |
| Red Hat:enterprise_linux:8 | tomcat-jsp-2.3-api | 1:9.0.62-27.el8_9 |
| Red Hat:enterprise_linux:8 | tomcat-lib | 1:9.0.62-27.el8_9 |
| Red Hat:enterprise_linux:8 | tomcat-servlet-4.0-api | 1:9.0.62-27.el8_9 |
| Red Hat:enterprise_linux:8 | tomcat-webapps | 1:9.0.62-27.el8_9 |
| Red Hat:enterprise_linux:9 | tomcat | 1:9.0.62-37.el9_3 |
| Red Hat:enterprise_linux:9 | tomcat-admin-webapps | 1:9.0.62-37.el9_3 |
| Red Hat:enterprise_linux:9 | tomcat-docs-webapp | 1:9.0.62-37.el9_3 |
| Red Hat:enterprise_linux:9 | tomcat-el-3.0-api | 1:9.0.62-37.el9_3 |
| Red Hat:enterprise_linux:9 | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3 |
| Red Hat:enterprise_linux:9 | tomcat-lib | 1:9.0.62-37.el9_3 |
| Red Hat:enterprise_linux:9 | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3 |
| Red Hat:enterprise_linux:9 | tomcat-webapps | 1:9.0.62-37.el9_3 |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-java-jdk11 | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-java-jdk8 | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-javadoc | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-javadoc | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-javadoc | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-lib | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-lib | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-lib | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-native | 0:1.2.31-15.redhat_15.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-native | 0:1.2.31-15.redhat_15.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-native | 0:1.2.31-15.redhat_15.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-15.redhat_15.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-15.redhat_15.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-15.redhat_15.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-selinux | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-selinux | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-selinux | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-webapps | 0:9.0.62-15.redhat_00013.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-webapps | 0:9.0.62-15.redhat_00013.1.el9jws |
| Red Hat:jboss_enterprise_web_server:5.7 | jws5-tomcat-webapps | 0:9.0.62-15.redhat_00013.1.el8jws |
| Red Hat:rhel_eus:8.8 | tomcat | 1:9.0.87-1.el8_8.2 |
| Red Hat:rhel_eus:8.8 | tomcat-admin-webapps | 1:9.0.87-1.el8_8.2 |
| Red Hat:rhel_eus:8.8 | tomcat-docs-webapp | 1:9.0.87-1.el8_8.2 |
| Red Hat:rhel_eus:8.8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_8.2 |
| Red Hat:rhel_eus:8.8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_8.2 |
| Red Hat:rhel_eus:8.8 | tomcat-lib | 1:9.0.87-1.el8_8.2 |
| Red Hat:rhel_eus:8.8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_8.2 |
| Red Hat:rhel_eus:8.8 | tomcat-webapps | 1:9.0.87-1.el8_8.2 |
| SUSE:Enterprise Storage 7 | tomcat | 9.0.43-150200.35.1 |
| SUSE:Enterprise Storage 7.1 | tomcat | 9.0.43-150200.35.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | tomcat | 9.0.36-150100.4.90.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | tomcat | 9.0.43-150200.35.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | tomcat | 9.0.43-150200.35.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | tomcat | 9.0.43-150200.35.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | tomcat | 9.0.43-150200.35.1 |
| SUSE:Linux Enterprise Server 12 SP4-ESPOS | tomcat | 9.0.36-3.102.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | tomcat | 9.0.36-3.102.1 |
| SUSE:Linux Enterprise Server 12 SP5 | tomcat | 9.0.36-3.102.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.115-3.160.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | tomcat | 9.0.36-150100.4.90.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | tomcat | 9.0.43-150200.35.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | tomcat | 9.0.43-150200.35.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.115-3.160.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | tomcat | 9.0.36-3.102.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 9.0.36-3.102.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | tomcat | 9.0.36-150100.4.90.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | tomcat | 9.0.43-150200.35.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | tomcat | 9.0.43-150200.35.1 |
| SUSE:Manager Server 4.2 | tomcat | 9.0.43-150200.35.1 |
| SUSE:OpenStack Cloud 9 | tomcat | 9.0.36-3.102.1 |
| SUSE:OpenStack Cloud Crowbar 9 | tomcat | 9.0.36-3.102.1 |
| Ubuntu:20.04:LTS | tomcat9 | 9.0.31-1ubuntu0.8 |
| Ubuntu:25.10 | tomcat9 | 9.0.70-2ubuntu3 |
| Ubuntu:Pro:14.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | 8.5.39-1ubuntu1~18.04.3+esm5 |
| Ubuntu:Pro:18.04:LTS | tomcat9 | 9.0.16-3ubuntu0.18.04.2+esm4 |
| Ubuntu:Pro:18.04:LTS | tomcat9 | 9.0.16-3ubuntu0.18.04.2+esm7 |
| Ubuntu:Pro:20.04:LTS | tomcat9 | 9.0.31-1ubuntu0.9+esm2 |
| Ubuntu:Pro:22.04:LTS | tomcat9 | 9.0.58-1ubuntu0.1+esm4 |
| Ubuntu:Pro:22.04:LTS | tomcat9 | 9.0.58-1ubuntu0.2+esm3 |
| Ubuntu:Pro:24.04:LTS | tomcat10 | 10.1.16-1ubuntu0.1~esm2 |
| Ubuntu:Pro:24.04:LTS | tomcat9 | 9.0.70-2ubuntu0.1+esm2 |
| openSUSE:Leap 15.4 | tomcat | 9.0.43-150200.35.1 |
| openSUSE:Tumbleweed | tomcat | 9.0.43-15.1 |
| openSUSE:Tumbleweed | tomcat10 | 10.1.14-1.1 |