Session Fixation The advisory has been revoked - it doesn't affect any version of package pki-servlet-4.0-api (opens in a new tab)

Threat Intelligence

10.69% (96^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL8-PKISERVLET40API-1333877
published26 Jul 2021
disclosed18 Dec 2019

Report a new vulnerability Found a mistake?

Introduced: 18 Dec 2019

CVE-2019-17563 (opens in a new tab) CWE-384 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pki-servlet-4.0-api package and not the pki-servlet-4.0-api package as distributed by RHEL.

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.