High severityNVD Advisory· Published Jun 21, 2023· Updated Feb 13, 2025
Apache Tomcat: AJP response header mix-up
CVE-2023-34981
Description
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-coreMaven | >= 11.0.0-M5, < 11.0.0-M6 | 11.0.0-M6 |
org.apache.tomcat.embed:tomcat-embed-coreMaven | >= 10.1.8, < 10.1.9 | 10.1.9 |
org.apache.tomcat.embed:tomcat-embed-coreMaven | >= 9.0.74, < 9.0.75 | 9.0.75 |
org.apache.tomcat:tomcat-coyoteMaven | >= 8.5.88, < 8.5.89 | 8.5.89 |
Affected products
4- osv-coords3 versionspkg:bitnami/tomcatpkg:maven/org.apache.tomcat.embed/tomcat-embed-corepkg:maven/org.apache.tomcat/tomcat-coyote
>= 8.5.88, < 8.5.89+ 2 more
- (no CPE)range: >= 8.5.88, < 8.5.89
- (no CPE)range: >= 11.0.0-M5, < 11.0.0-M6
- (no CPE)range: >= 8.5.88, < 8.5.89
- Apache Software Foundation/Apache Tomcatv5Range: 11.0.0-M5
Patches
Vulnerability mechanics
References
15- github.com/advisories/GHSA-mppv-79ch-vw6qghsaADVISORY
- lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qzghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-34981ghsaADVISORY
- bz.apache.org/bugzilla/show_bug.cgighsaWEB
- bz.apache.org/bugzilla/show_bug.cgighsaWEB
- github.com/apache/tomcat/commit/2214c8030522aa9b2a367dfa5d9acff1a03666aeghsaWEB
- github.com/apache/tomcat/commit/2f0ca2378415f4cf0748f4bc8fa955f41f803fa5ghsaWEB
- github.com/apache/tomcat/commit/739c7381aed22b7636351caf885ddc519ab6b442ghsaWEB
- github.com/apache/tomcat/commit/f0742f47b98aca943097f7f88e0d1163f57527e3ghsaWEB
- security.netapp.com/advisory/ntap-20230714-0003ghsaWEB
- tomcat.apache.org/security-10.htmlghsaWEB
- tomcat.apache.org/security-11.htmlghsaWEB
- tomcat.apache.org/security-8.htmlghsaWEB
- tomcat.apache.org/security-9.htmlghsaWEB
- security.netapp.com/advisory/ntap-20230714-0003/mitre
News mentions
0No linked articles in our index yet.