CVE-2023-28708
Publication date 22 March 2023
Last updated 13 August 2025
Ubuntu priority
Cvss 3 Severity Score
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
Status
Package | Ubuntu Release | Status |
---|---|---|
tomcat10 | 25.04 plucky |
Not affected
|
24.04 LTS noble |
Not affected
|
|
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Ignored end of standard support | |
tomcat8 | ||
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Fixed 8.5.39-1ubuntu1~18.04.3+esm5
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Ignored end of standard support | |
tomcat9 | 25.04 plucky |
Fixed 9.0.70-2ubuntu1.25.04.2
|
24.04 LTS noble |
Fixed 9.0.70-2ubuntu0.1+esm2
|
|
22.04 LTS jammy |
Fixed 9.0.58-1ubuntu0.1+esm4
|
|
20.04 LTS focal |
Fixed 9.0.31-1ubuntu0.8
|
|
18.04 LTS bionic |
Fixed 9.0.16-3ubuntu0.18.04.2+esm4
|
|
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Ignored end of standard support |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
Parameter | Value |
---|---|
Base score |
|
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | Low |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-7106-1
- Tomcat vulnerabilities
- 13 November 2024
- USN-7562-1
- Tomcat vulnerabilities
- 9 June 2025