MediumFix available
tomcat10, tomcat9 — security advisory
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
- Products
- tomcat10, tomcat9
- Affected versions
- Not specified
- Fixed versions
- 10.1.6-1, 9.0.70-2
- CVEs
- CVE-2023-28708
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 15:30 UTC · Revision 1
Source evidence
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
osv:DEBIAN-CVE-2023-28708
tomcat10
Fixed versions: 10.1.6-1
tomcat10
Fixed versions: 10.1.6-1
tomcat10
Fixed versions: 10.1.6-1
tomcat9
Fixed versions: 9.0.70-2
tomcat9
Fixed versions: 9.0.70-2
tomcat9
Fixed versions: 9.0.70-2
Complete source record
{
"id": "b2abd9e4cc29e0a059dc2026fcae05862e2d0dbb50088083a434239b41d7a822",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2023-28708",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2023-28708",
"summary": "When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.",
"evidence": "osv:DEBIAN-CVE-2023-28708",
"products": [
{
"name": {
"value": "tomcat10",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.1.6-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat10",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.1.6-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat10",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.1.6-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.70-2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.70-2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.70-2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2023-28708",
"aliases": [
"DEBIAN-CVE-2023-28708"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "10.1.6-1"
}
]
}
],
"package": {
"name": "tomcat10",
"purl": "pkg:deb/debian/tomcat10?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28708.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "10.1.6-1"
}
]
}
],
"package": {
"name": "tomcat10",
"purl": "pkg:deb/debian/tomcat10?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28708.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "10.1.6-1"
}
]
}
],
"package": {
"name": "tomcat10",
"purl": "pkg:deb/debian/tomcat10?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28708.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.70-2"
}
]
}
],
"package": {
"name": "tomcat9",
"purl": "pkg:deb/debian/tomcat9?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28708.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.70-2"
}
]
}
],
"package": {
"name": "tomcat9",
"purl": "pkg:deb/debian/tomcat9?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28708.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.70-2"
}
]
}
],
"package": {
"name": "tomcat9",
"purl": "pkg:deb/debian/tomcat9?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28708.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T18:00:49.949828943Z",
"provider": "osv",
"upstream": [
"CVE-2023-28708"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2023-28708"
]
},
"related_cves": [
{
"value": "CVE-2023-28708",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 455199,
"published_at": "2023-03-22T11:15:10.623+00:00"
}