Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 374619 - www-servers/tomcat: session hijack (CVE-2010-4312)
Summary: www-servers/tomcat: session hijack (CVE-2010-4312)
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B4 [glsa]
Depends on:
Blocks: 322979
  Show dependency tree
Reported: 2011-07-10 00:20 UTC by GLSAMaker/CVETool Bot
Modified: 2012-06-24 14:12 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2011-07-10 00:20:32 UTC
CVE-2010-4312 (
  The default configuration of Apache Tomcat 6.x does not include the HTTPOnly
  flag in a Set-Cookie header, which makes it easier for remote attackers to
  hijack a session via script access to a cookie.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2011-07-10 00:21:34 UTC
Can you punt anything <www-servers/tomcat-6.0.32-r2?
Comment 2 Tobias Heinlein (RETIRED) gentoo-dev 2011-10-22 17:44:45 UTC
Ignoring comment #1, what's your plan here? I was unable to find a statement from upstream, but Red Hat's security team issued a statement:
Comment 3 Miroslav Šulc gentoo-dev 2011-10-22 18:54:52 UTC
(In reply to comment #1)
> Can you punt anything <www-servers/tomcat-6.0.32-r2?

done, except www-servers/tomcat-6.0.32-r2 has been never stable so it's gone too, remained www-servers/tomcat-6.0.32-r1 until www-servers/tomcat-6.0.33 is stabilized
Comment 4 Miroslav Šulc gentoo-dev 2012-03-25 20:25:10 UTC
no affected version in the tree anymore
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2012-06-24 14:12:51 UTC
This issue was resolved and addressed in
 GLSA 201206-24 at
by GLSA coordinator Tobias Heinlein (keytoaster).