CVE-2023-34981: Apache Tomcat: AJP response header mix-up
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS message would be sent for the response which in turn meant that at least one AJP proxy (modproxyajp) would use the response headers from the previous request leading to an information leak.
Other sources
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (modproxyajp) would use the response headers from the previous request leading to an information leak.
Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a flaw when a response did not have any HTTP headers set. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-coyoteto a version that resolves this vulnerability.Fixed in 8.5.89 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 9.0.75 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 10.1.9 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 11.0.0-M6
Event History
Frequently Asked Questions
What is the severity of CVE-2023-34981?
The severity of CVE-2023-34981 is high.
Which versions of Apache Tomcat are affected by CVE-2023-34981?
Apache Tomcat versions 8.5.88, 9.0.74, 10.1.8, and 11.0.0-M5 are affected by CVE-2023-34981.
How does CVE-2023-34981 affect Apache Tomcat?
CVE-2023-34981 in Apache Tomcat can cause a regression in the fix for bug 66512, resulting in the failure to send AJP SEND_HEADERS messages for responses without any HTTP headers.
How can I fix CVE-2023-34981 in Apache Tomcat?
To fix CVE-2023-34981, upgrade to Apache Tomcat versions 8.5.89, 9.0.75, 10.1.9, or 11.0.0-M6.
Where can I find more information about CVE-2023-34981?
You can find more information about CVE-2023-34981 at the following references: [Link 1](https://nvd.nist.gov/vuln/detail/CVE-2023-34981), [Link 2](https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qz), [Link 3](https://bz.apache.org/bugzilla/show_bug.cgi?id=66512).