Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Ubuntu 22.04 LTS USN-7106-1: Critical Tomcat Security Issues

ubuntu
Calendar Grey November 18, 2024
Dist Ubuntu Esm H88
Multiple vulnerabilities patched in Tomcat with the latest releases for Ubuntu 22.04, 20.04, and 18.04 tackling serious threats.
Several security issues were fixed in Tomcat.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in Tomcat. Software Description: - tomcat9: Servlet and JSP engine Details: It was discovered that Tomcat did not include the secure attribute for session cookies when using the RemoteIpFilter with requests from a reverse proxy. An attacker could possibly use this issue to leak sensitive information. (CVE-2023-28708) It was discovered that Tomcat had a vulnerability in its FORM authentication feature, leading to an open redirect attack. An attacker could possibly use this issue to perform phishing attacks. (CVE-2023-41080) It was discovered that Tomcat incorrectly recycled certain objects, which could lead to information leaking from one request to the next. An attacker could potentially use this issue to leak sensitive information. (CVE-2023-42795) It was discovered that To...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service information leak attack tomcat ubuntu

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS   libtomcat9-java                 9.0.58-1ubuntu0.1+esm4                                   Available with Ubuntu Pro   tomcat9                         9.0.58-1ubuntu0.1+esm4                                   Available with Ubuntu Pro Ubuntu 20.04 LTS   libtomcat9-java                 9.0.31-1ubuntu0.8   tomcat9                         9.0.31-1ubuntu0.8 Ubuntu 18.04 LTS   libtomcat9-java                 9.0.16-3ubuntu0.18.04.2+esm4                                   Available with Ubuntu Pro   tomcat9                         9.0.16-3ubuntu0.18.04.2+esm4                                   Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-7106-1

  CVE-2023-28708, CVE-2023-41080, CVE-2023-42795, CVE-2023-45648,

  CVE-2024-23672

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7106-1

Topics%20covered

Topics Covered

security advisory denial of service information leak attack tomcat ubuntu

Package Information

  https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.8

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here