Vulnerability · Published Jun 21, 2023 · Assigned by apache
CVE-2023-34981Apache Tomcat: AJP response header mix-up
High 7.5
In plain English
A high-severity incorrect permission assignment in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | tomcat10 | 10.1.10-1 | DEBIAN-CVE-2023-34981 |
| Debian:14 | tomcat10 | 10.1.10-1 | DEBIAN-CVE-2023-34981 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 11.0.0-M6 | GHSA-mppv-79ch-vw6q |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.1.9 | GHSA-mppv-79ch-vw6q |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.75 | GHSA-mppv-79ch-vw6q |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.89 | GHSA-mppv-79ch-vw6q |
| Ubuntu:22.04:LTS | tomcat9 | no fix listed | UBUNTU-CVE-2023-34981 |
| Ubuntu:24.04:LTS | tomcat9 | no fix listed | UBUNTU-CVE-2023-34981 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.0-M510.1.89.0.748.5.88 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N