CVE-2008-0128

中 5.0CVE-2008-0128 · 23/01/2008 公開 · 16/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
tomcat apache	`≤ 5.5.20`	修正版なし

概要

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

参考情報

community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
issues.apache.org/bugzilla/show_bug.cgi · Patch
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
rhn.redhat.com/errata/RHSA-2008-0630.html
secunia.com/advisories/28549 · Vendor Advisory
secunia.com/advisories/28552 · Vendor Advisory
secunia.com/advisories/29242
secunia.com/advisories/31493
secunia.com/advisories/33668
security-tracker.debian.net/tracker/CVE-2008-0128
support.ca.com/irj/portal/anonymous/phpsupcontent
debian.org/security/2008/dsa-1468
redhat.com/support/errata/RHSA-2008-0261.html
securityfocus.com/archive/1/500396/100/0/threaded
securityfocus.com/archive/1/500412/100/0/threaded
securityfocus.com/bid/27365
vupen.com/english/advisories/2008/0192
vupen.com/english/advisories/2009/0233
exchange.xforce.ibmcloud.com/vulnerabilities/39804
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン