CVE-2023-34981
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- apache/tomcat
- Source
- security@apache.org
References
- https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qzMailing List, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230714-0003/Third Party Advisory
- https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qzMailing List, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230714-0003/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.