Information Exposure Affecting jws5-tomcat package, versions <0:9.0.62-15.redhat_00013.1.el8jws


Severity

Recommended
0.0
medium
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.13% (50th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-JWS5TOMCAT-4403180
  • published24 Mar 2023
  • disclosed22 Mar 2023

Introduced: 22 Mar 2023

CVE-2023-28708  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

Upgrade RHEL:8 jws5-tomcat to version 0:9.0.62-15.redhat_00013.1.el8jws or higher.
This issue was patched in RHSA-2023:4909.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jws5-tomcat package and not the jws5-tomcat package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

CVSS Scores

version 3.1