Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28708: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. CVE-2017-12616: When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | tomcat | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-admin-webapps | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-docs-webapp | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-el-2.2-api | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-javadoc | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-jsp-2.2-api | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-jsvc | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-lib | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-servlet-3.0-api | 0:7.0.76-10.amzn2.0.3 |
| Amazon Linux · 2 | tomcat-webapps | 0:7.0.76-10.amzn2.0.3 |
Vulnerabilities 2
-
High 7.5CVE-2017-12616 EPSS 70%
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
-
Medium 4.3
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8…