CVE-2008-0128

Published: Jan 23, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Affected (1)

Products: Apache: Tomcat

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Up to 5.5.20

Related CWEs

References (44)

http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx

Source: cve@mitre.org

http://issues.apache.org/bugzilla/show_bug.cgi?id=41217

Source: cve@mitre.org

Patch

http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2008-0630.html

Source: cve@mitre.org

http://secunia.com/advisories/28549

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28552

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29242

Source: cve@mitre.org

http://secunia.com/advisories/31493

Source: cve@mitre.org

http://secunia.com/advisories/33668

Source: cve@mitre.org

http://security-tracker.debian.net/tracker/CVE-2008-0128

Source: cve@mitre.org

http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1468

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0261.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/500396/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/500412/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27365

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0192

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/0233

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/39804

Source: cve@mitre.org

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Source: cve@mitre.org

http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

http://issues.apache.org/bugzilla/show_bug.cgi?id=41217

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2008-0630.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/28549

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/28552

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/29242

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/31493

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33668

Source: af854a3a-2127-422b-91ae-364da2661108

http://security-tracker.debian.net/tracker/CVE-2008-0128

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2008/dsa-1468

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2008-0261.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/500396/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/500412/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/27365

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/0192

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/0233

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/39804

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.