Description
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_3.2 | RHSA-2009:1164 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_18rh | RHSA-2009:1563 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.16 | RHSA-2009:1562 |
| Red Hat Network Satellite 5 | tomcat5 +5 | 5.5.23-0jpp_18rh | RHSA-2009:1616 |
| Red Hat JBoss Web Server 1 | tomcat5 +10 | 5.5.23-0jpp.9.6.ep5.el5 | RHSA-2009:1454 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure EDB-31130 · remote · Feb 9, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.15 | 6.0.15 | GHSA-cww4-vj5r-rx57 |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.26 | 5.5.26 | GHSA-cww4-vj5r-rx57 |
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, < 4.1.37 | 4.1.37 | GHSA-cww4-vj5r-rx57 |
Advisories 6
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1164 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1616 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1563 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1562 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1454 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- ADV-2008-2690 vdb-entry
- 33330 third-party-advisory
- http://tomcat.apache.org/security-4.html
- http://support.apple.com/kb/HT2163
- 30676 third-party-advisory
- 27706 vdb-entry
- 3636 third-party-advisory
- JVN#09470767 third-party-advisory
- ADV-2008-1981 vdb-entry
- IZ20133 vendor-advisory
- oval:org.mitre.oval:def:11177 vdb-entry signature
- 28915 third-party-advisory
- 37460 third-party-advisory
- IZ20991 vendor-advisory
- 31681 vdb-entry
- 28884 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 20080208 [SECURITY] CVE-2007-5333: Tomcat Cookie handling vulnerabilities mailing-list
- http://www-01.ibm.com/support/docview.wss?uid=swg27012048
- 28878 third-party-advisory
- 32036 third-party-advisory
- ADV-2008-0488 vdb-entry
- 44183 third-party-advisory
- APPLE-SA-2008-06-30 vendor-advisory
- MDVSA-2010:176 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- SUSE-SR:2009:004 vendor-advisory
- MDVSA-2009:018 vendor-advisory
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.html
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- 32222 third-party-advisory
- 30802 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg27012047
- FEDORA-2008-1467 vendor-advisory
- GLSA-200804-10 vendor-advisory
- FEDORA-2008-1603 vendor-advisory
- ADV-2008-1856 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- http://tomcat.apache.org/security-5.html
- ADV-2008-2780 vdb-entry
- HPSBST02955 vendor-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- http://www-01.ibm.com/support/docview.wss?uid=swg24018932
- 29711 third-party-advisory
- ADV-2009-3316 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=532111
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list