CVE-2010-4312

Publication date 26 November 2010

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Description

The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.

Read the notes from the security team

Status

Package Ubuntu Release Status
tomcat5 10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Ignored end of life
tomcat5.5 10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy Ignored end of life
6.06 LTS dapper Not in release
tomcat6 10.10 maverick Ignored end of life
10.04 LTS lucid Ignored end of life
9.10 karmic Ignored end of life
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release

Notes

kees

fixed going forward in Tomcat 7; really a configuration issue for sites.

References

Other references