CVE-2023-41080

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project

Security Fix(es):

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.

The vulnerability is limited to the ROOT (default) web application.(CVE-2023-41080)

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)
• tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
• tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
• tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)
• tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
• tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
• tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0 through 11.0.0, from 10.1.0 through 10.0.12, from 9.0.0 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected.

The vulnerability is limited to the ROOT (default) web application.

• SECURITY UPDATE: Untrusted Site Redirection Vulnerability in FORM authentication feature
  • debian/patches/CVE-2023-41080.patch: Avoid protocol relative redirects in FORM authentication
  • CVE-2023-41080

• SECURITY UPDATE: Security vulnerability in URL redirection
  • debian/patches/CVE-2023-41080.patch: Avoid protocol relative redirects in FORM authentication
  • CVE-2023-41080

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.

TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 7.0.70-tuxcare.2.

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

TuxCare rebuilt 7 packages to address 13 CVEs. Fixed in 8.5.78-tuxcare.1.

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected.

The vulnerability is limited to the ROOT (default) web application.

These are all security issues fixed in the tomcat-9.0.80-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2023-41080 in the org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available.

This update for tomcat fixes the following issues:

• CVE-2023-41080: Fixed URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature (bsc#1214666).

This update for tomcat fixes the following issues:

Tomcat was updated to version 9.0.82 (jsc#PED-6376, jsc#PED-6377):

• Security issues fixed:

  • CVE-2023-41080: Avoid protocol relative redirects in FORM authentication. (bsc#1214666)
  • CVE-2023-44487: Fix HTTP/2 Rapid Reset Attack. (bsc#1216182)

• Update to Tomcat 9.0.82:

  • Catalina

    • Add: 65770: Provide a lifecycle listener that will automatically reload TLS configurations a set time before the certificate is due to expire. This is intended to be used with third-party tools that regularly renew TLS certificates.
    • Fix: Fix handling of an error reading a context descriptor on deployment.
    • Fix: Fix rewrite rule qsd (query string discard) being ignored if qsa was also use, while it should instead take precedence.
    • Fix: 67472: Send fewer CORS-related headers when CORS is not actually being engaged.
    • Add: Improve handling of failures within recycle() methods.

  • Coyote

    • Fix: 67670: Fix regression with HTTP compression after code refactoring.
    • Fix: 67198: Ensure that the AJP connector attribute tomcatAuthorization takes precedence over the tomcatAuthentication attribute when processing an auth_type attribute received from a proxy server.
    • Fix: 67235: Fix a NullPointerException when an AsyncListener handles an error with a dispatch rather than a complete.
    • Fix: When an error occurs during asynchronous processing, ensure that the error handling process is only triggered once per asynchronous cycle.
    • Fix: Fix logic issue trying to match no argument method in IntropectionUtil.
    • Fix: Improve thread safety around readNotify and writeNotify in the NIO2 endpoint.
    • Fix: Avoid rare thread safety issue accessing message digest map.
    • Fix: Improve statistics collection for upgraded connections under load.
    • Fix: Align validation of HTTP trailer fields with standard fields.
    • Fix: Improvements to HTTP/2 overhead protection (bsc#1216182, CVE-2023-44487)

  • jdbc-pool

    • Fix: 67664: Correct a regression in the clean-up of unnecessary use of fully qualified class names in 9.0.81 that broke the jdbc-pool.

  • Jasper

    • Fix: 67080: Improve performance of EL expressions in JSPs that use implicit objects

• Update to Tomcat 9.0.80 (jsc#PED-6376, jsc#PED-6377):

  • Catalina:

    • Add RateLimitFilter which can be used to mitigate DoS and Brute Force attacks
    • Move the management of the utility executor from the init()/destroy() methods of components to the start()/stop() methods.
    • Add org.apache.catalina.core.StandardVirtualThreadExecutor, a virtual thread based executor that may be used with one or more Connectors to process requests received by those Connectors using virtual threads. This Executor requires a minimum Java version of Java 21.
    • Add a per session Semaphore to the PersistentValve that ensures that, within a single Tomcat instance, there is no more than one concurrent request per session. Also expand the debug logging to include whether a request bypasses the Valve and the reason if a request fails to obtain the per session Semaphore.
    • Ensure that the default servlet correctly escapes file names in directory listings when using XML output.
    • Add a numeric last modified field to the XML directory listings produced by the default servlet to enable sorting in the XSLT.
    • Attempts to lock a collection with WebDAV may incorrectly fail if a child collection has an expired lock.
    • Deprecate the xssProtectionEnabled setting from the HttpHeaderSecurityFilter and change the default value to false as support for the associated HTTP header has been removed from all major browsers.
    • Add org.apache.catalina.core.ContextNamingInfoListener, a listener which creates…

This update for tomcat fixes the following issues:

• CVE-2023-42795: Fixed a potential information leak due to insufficient cleanup (bsc#1216119).
• CVE-2023-45648: Fixed a request smuggling issue due to an incorrect parsing of HTTP trailer headers (bsc#1216118).
• CVE-2023-41080: Fixed URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature (bsc#1214666).

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.115:

• CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
• CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
• CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
• CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
• CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
• CVE-2023-44487: Rapid reset attack (bsc#1216182).

It was discovered that Tomcat did not include the secure attribute for session cookies when using the RemoteIpFilter with requests from a reverse proxy. An attacker could possibly use this issue to leak sensitive information. (CVE-2023-28708)

It was discovered that Tomcat had a vulnerability in its FORM authentication feature, leading to an open redirect attack. An attacker could possibly use this issue to perform phishing attacks. (CVE-2023-41080)

It was discovered that Tomcat incorrectly recycled certain objects, which could lead to information leaking from one request to the next. An attacker could potentially use this issue to leak sensitive information. (CVE-2023-42795)

It was discovered that Tomcat incorrectly handled HTTP trailer headers. A remote attacker could possibly use this issue to perform HTTP request smuggling. (CVE-2023-45648)

It was discovered that Tomcat incorrectly handled socket cleanup, which could lead to websocket connections staying open. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-23672)