Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 598
Alerts This Week
Warning Icon 1 598

Ubuntu 22.04 LTS USN-7106-1: Critical Tomcat Security Issues

ubuntu
Calendar Grey November 18, 2024
Scroller Ubuntu
Multiple vulnerabilities patched in Tomcat with the latest releases for Ubuntu 22.04, 20.04, and 18.04 tackling serious threats.
Several security issues were fixed in Tomcat.

Summary

Several security issues were fixed in Tomcat.

Software Description:

- tomcat9: Servlet and JSP engine

Details:

It was discovered that Tomcat did not include the secure attribute for

session cookies when using the RemoteIpFilter with requests from a

reverse proxy. An attacker could possibly use this issue to leak

sensitive information. (CVE-2023-28708)

It was discovered that Tomcat had a vulnerability in its FORM

authentication feature, leading to an open redirect attack. An attacker

could possibly use this issue to perform phishing attacks. (CVE-2023-41080)

It was discovered that Tomcat incorrectly recycled certain objects,

which could lead to information leaking from one request to the next.

An attacker could potentially use this issue to leak sensitive

information. (CVE-2023-42795)

It was discovered that Tomcat incorrectly handled HTTP trailer headers. A

remote attacker could possibly use this issue to perform HTTP request

smuggling. (CVE-2023-45648)

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service information leak attack tomcat ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
   libtomcat9-java                 9.0.58-1ubuntu0.1+esm4
                                   Available with Ubuntu Pro
   tomcat9                         9.0.58-1ubuntu0.1+esm4
                                   Available with Ubuntu Pro

Ubuntu 20.04 LTS
   libtomcat9-java                 9.0.31-1ubuntu0.8
   tomcat9                         9.0.31-1ubuntu0.8

Ubuntu 18.04 LTS
   libtomcat9-java                 9.0.16-3ubuntu0.18.04.2+esm4
                                   Available with Ubuntu Pro
   tomcat9                         9.0.16-3ubuntu0.18.04.2+esm4
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-7106-1

  CVE-2023-28708, CVE-2023-41080, CVE-2023-42795, CVE-2023-45648,

  CVE-2024-23672

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7106-1

Topics%20covered

Topics Covered

security advisory denial of service information leak attack tomcat ubuntu

Package Information

  https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.8

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.