CVE-2023-34981

EUVD-2023-1844
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
Affected Products (NVD)
VendorProductVersion
apachetomcat
8.5.88
apachetomcat
9.0.74
apachetomcat
10.1.8
apachetomcat
11.0.0:milestone5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tomcat10
bookworm
10.1.6-1+deb12u2
not-affected
bookworm (security)
10.1.6-1+deb12u2
fixed
sid
10.1.34-1
fixed
trixie
10.1.34-1
fixed
tomcat9
bookworm
9.0.70-2
not-affected
bullseye
9.0.43-2~deb11u10
fixed
bullseye (security)
9.0.43-2~deb11u10
fixed
sid
9.0.95-1
fixed
trixie
9.0.95-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tomcat6
bionic
dne
focal
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
ignored
xenial
needs-triage
tomcat7
bionic
needs-triage
focal
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
ignored
xenial
needs-triage
tomcat8
bionic
needs-triage
focal
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
dne
xenial
needs-triage
tomcat9
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
needs-triage
trusty
dne
xenial
dne