UBUNTU-CVE-2023-34981
Dashboard / Vulnerabilities / UBUNTU-CVE-2023-34981
Summary:
Details: A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
References: https://ubuntu.com/security/CVE-2023-34981, https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qz, https://www.cve.org/CVERecord?id=CVE-2023-34981
Affected packages
Package
Name: tomcat6
Purl: pkg:deb/ubuntu/[email protected]+esm2?arch=source&distro=esm-infra-legacy/trusty
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
6.0.37-1
6.0.39-1
6.0.39-1ubuntu0.1
6.0.39-1ubuntu0.1+esm1
6.0.39-1ubuntu0.1+esm2
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
