CVE-2023-28708

When using the RemoteIpFilter with requests received from a    reverse proxy via HTTP that include the X-Forwarded-Proto    header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Older, EOL versions may also be affected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
apachetomcat
8.5.0 ≤
𝑥
< 8.5.86
apachetomcat
9.0.0 <
𝑥
< 9.0.72
apachetomcat
10.1.0 <
𝑥
< 10.1.6
apachetomcat
11.0.0:milestone1
apachetomcat
11.0.0:milestone2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tomcat10
bookworm
10.1.6-1+deb12u2
fixed
bookworm (security)
10.1.6-1+deb12u2
fixed
sid
10.1.34-1
fixed
trixie
10.1.34-1
fixed
tomcat9
bookworm
9.0.70-2
fixed
bullseye
9.0.43-2~deb11u10
fixed
bullseye (security)
9.0.43-2~deb11u10
fixed
sid
9.0.95-1
fixed
trixie
9.0.95-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tomcat10
bionic
dne
focal
dne
jammy
dne
kinetic
dne
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
needs-triage
trusty
ignored
xenial
ignored
tomcat8
bionic
needs-triage
focal
dne
jammy
dne
kinetic
dne
trusty
ignored
xenial
needs-triage
tomcat9
bionic
Fixed 9.0.16-3ubuntu0.18.04.2+esm4
released
focal
Fixed 9.0.31-1ubuntu0.8
released
jammy
Fixed 9.0.58-1ubuntu0.1+esm4
released
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
needs-triage
trusty
ignored
xenial
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
tomcat
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise sap 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise sap 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP7
9.0.43-150200.35.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise server 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP7
9.0.43-150200.35.1
fixed
tomcat-admin-webapps
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise sap 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise sap 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP7
9.0.43-150200.35.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise server 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP7
9.0.43-150200.35.1
fixed
tomcat-docs-webapp
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
tomcat-el-3_0-api
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise sap 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise sap 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP7
9.0.43-150200.35.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise server 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP7
9.0.43-150200.35.1
fixed
tomcat-javadoc
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
tomcat-jsp-2_3-api
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise sap 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise sap 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP7
9.0.43-150200.35.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise server 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP7
9.0.43-150200.35.1
fixed
tomcat-lib
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise sap 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise sap 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP7
9.0.43-150200.35.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise server 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP7
9.0.43-150200.35.1
fixed
tomcat-servlet-4_0-api
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise sap 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise sap 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP7
9.0.43-150200.35.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise server 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP7
9.0.43-150200.35.1
fixed
tomcat-webapps
suse enterprise sap 12 SP4
9.0.36-3.102.1
fixed
suse enterprise sap 12 SP5
9.0.36-3.102.1
fixed
suse enterprise sap 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise sap 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise sap 15 SP7
9.0.43-150200.35.1
fixed
suse enterprise server 12 SP4
9.0.36-3.102.1
fixed
suse enterprise server 12 SP5
9.0.115-3.160.1
fixed
suse enterprise server 15 SP1
9.0.36-150100.4.90.1
fixed
suse enterprise server 15 SP2
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP3
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP4
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP5
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP6
9.0.43-150200.35.1
fixed
suse enterprise server 15 SP7
9.0.43-150200.35.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
tomcat
RHEL 8
1:9.0.62-27.el8_9
fixed
RHEL 9
1:9.0.62-37.el9_3
fixed
tomcat-admin-webapps
RHEL 8
1:9.0.62-27.el8_9
fixed
RHEL 9
1:9.0.62-37.el9_3
fixed
tomcat-docs-webapp
RHEL 8
1:9.0.62-27.el8_9
fixed
RHEL 9
1:9.0.62-37.el9_3
fixed
tomcat-el-3.0-api
RHEL 8
1:9.0.62-27.el8_9
fixed
RHEL 9
1:9.0.62-37.el9_3
fixed
tomcat-jsp-2.3-api
RHEL 8
1:9.0.62-27.el8_9
fixed
RHEL 9
1:9.0.62-37.el9_3
fixed
tomcat-lib
RHEL 8
1:9.0.62-27.el8_9
fixed
RHEL 9
1:9.0.62-37.el9_3
fixed
tomcat-servlet-4.0-api
RHEL 8
1:9.0.62-27.el8_9
fixed
RHEL 9
1:9.0.62-37.el9_3
fixed
tomcat-webapps
RHEL 8
1:9.0.62-27.el8_9
fixed
RHEL 9
1:9.0.62-37.el9_3
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
tomcat
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-admin-webapps
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-docs-webapp
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-el-2.2-api
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-javadoc
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-jsp-2.2-api
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-jsvc
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-lib
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-servlet-3.0-api
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat-webapps
Amazon Linux 2
0:7.0.76-10.amzn2.0.3
fixed
tomcat8
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-admin-webapps
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-docs-webapp
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-el-3.0-api
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-javadoc
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-jsp-2.3-api
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-lib
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-log4j
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-servlet-3.1-api
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat8-webapps
Amazon Linux 1
0:8.5.87-1.92.amzn1
fixed
tomcat9
Amazon Linux 2023
1:9.0.71-1.amzn2023.0.2
fixed
tomcat9-admin-webapps
Amazon Linux 2023
1:9.0.71-1.amzn2023.0.2
fixed
tomcat9-docs-webapp
Amazon Linux 2023
1:9.0.71-1.amzn2023.0.2
fixed
tomcat9-el-3.0-api
Amazon Linux 2023
1:9.0.71-1.amzn2023.0.2
fixed
tomcat9-jsp-2.3-api
Amazon Linux 2023
1:9.0.71-1.amzn2023.0.2
fixed
tomcat9-lib
Amazon Linux 2023
1:9.0.71-1.amzn2023.0.2
fixed
tomcat9-servlet-4.0-api
Amazon Linux 2023
1:9.0.71-1.amzn2023.0.2
fixed
tomcat9-webapps
Amazon Linux 2023
1:9.0.71-1.amzn2023.0.2
fixed
Common Weakness Enumeration
References
https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67
https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67
https://security.netapp.com/advisory/ntap-20230331-0012/