CVE-2023-34981
published 2023-06-21CVE-2023-34981: A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.12%
62.4th percentile
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| debian | tomcat10 | < tomcat10 10.1.10-1 (forky) | tomcat10 10.1.10-1 (forky) |
| debian | tomcat9 | < tomcat10 10.1.10-1 (forky) | tomcat10 10.1.10-1 (forky) |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_apache7.5HIGH
vendor_debian7.5LOW
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Retail Applications Risk Matrix: Xenvironment (Apache Tomcat) — CVE-2023-34981
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2023-34981 [HIGH] Oracle Oracle Retail Applications Risk Matrix: Xenvironment (Apache Tomcat) — CVE-2023-34981
Oracle Oracle Retail Applications Risk Matrix: Xenvironment (Apache Tomcat) vulnerability
CVE: CVE-2023-34981
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Installation (Apache Tomcat) — CVE-2023-34981
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2023-34981 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Installation (Apache Tomcat) — CVE-2023-34981
Oracle Oracle Communications Applications Risk Matrix: Installation (Apache Tomcat) vulnerability
CVE: CVE-2023-34981
CVSS: 7.5
Protocol: XMPP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Tomcat) — CVE-2023-34981
vendor_oracle·2023-10-15·CVSS 7.5
CVE-2023-34981 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Core (Apache Tomcat) — CVE-2023-34981
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Tomcat) vulnerability
CVE: CVE-2023-34981
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Red Hat
tomcat: response headers from the previous request leading to an information leak
vendor_redhat·2023-06-21·CVSS 7.5
CVE-2023-34981 [HIGH] CWE-200 tomcat: response headers from the previous request leading to an information leak
tomcat: response headers from the previous request leading to an information leak
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
A flaw was found in Tomcat. If a response did not have any HTTP headers set, no AJP SEND_HEADERS message would be sent, resulting in at least one AJP based proxy (mod_proxy_ajp) using the response headers from the previous request for the current request, leading to an information leak. The information leaked may give a user sensitive information whic
Debian
CVE-2023-34981: tomcat10 - A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74...
vendor_debian·2023·CVSS 7.5
CVE-2023-34981 [HIGH] CVE-2023-34981: tomcat10 - A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74...
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
Scope: local
bookworm: resolved
forky: resolved (fixed in 10.1.10-1)
sid: resolved (fixed in 10.1.10-1)
trixie: resolved (fixed in 10.1.10-1)
Apache
Apache tomcat: CVE-2023-34981
vendor_apache·CVSS 7.5
CVE-2023-34981 [HIGH] Apache tomcat: CVE-2023-34981
Apache tomcat: CVE-2023-34981
The fix for bug 66512 introduced a regression that was fixed as bug 66591 . The regression meant that, if a response did not have any HTTP headers set, no AJP SEND_HEADERS message would be sent which in turn meant that at least one AJP based proxy (mod_proxy_ajp) would use the response headers from the previous request for the current request leading to an information leak. This was fixed with commit 2214c803 . This issue was reported to the Tomcat Security Team on 24 May 2023. The issue was made public on 21 June 2023. Affects: 8.5.88 2023-04-19 Fixed in Apache Tomcat 8.5.88 Moderate: Apache Tomcat denial of service
GHSA
Apache Tomcat vulnerable to information leak
ghsa·2023-06-21
CVE-2023-34981 [HIGH] CWE-732 Apache Tomcat vulnerable to information leak
Apache Tomcat vulnerable to information leak
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS message would be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
OSV
CVE-2023-34981: A regression in the fix for bug 66512 in Apache Tomcat 11
osv·2023-06-21·CVSS 7.5
CVE-2023-34981 [HIGH] CVE-2023-34981: A regression in the fix for bug 66512 in Apache Tomcat 11
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
OSV
Apache Tomcat vulnerable to information leak
osv·2023-06-21
CVE-2023-34981 [HIGH] Apache Tomcat vulnerable to information leak
Apache Tomcat vulnerable to information leak
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS message would be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-21
Published