Session Fixation in Apache Tomcat - CVE-2019-17563

Vulnerability identifier: #VU25002

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17563

CWE-ID: CWE-384

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a session fixation attack.

The vulnerability exists due to a race condition when FORM authentication is used in Apache Tomcat. A remote attacker can use a narrow window to perform a session fixation attack.

Apache Tomcat
Cloud Foundry UAA
Amazon Linux AMI
Gentoo Linux
Fedora
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Opensuse
BIG-IP
Dell Support Assist Enterprise
Oracle Agile Engineering Data Management
Oracle Retail Order Broker
MySQL Enterprise Monitor
Oracle Database Server
tomcat (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
tomcat9 (Debian package)
tomcat
Infrastructure Technology
MICROS Relate CRM Software
Instantis EnterpriseTrack
CF Deployment

Install updates from vendor's website.

Apache Tomcat - addressed in versions 7.0.99, 8.5.50, 9.0.30
Dell Support Assist Enterprise - update to 4.00.06.00
tomcat (Red Hat package) - addressed in versions 7.0.76-11.el7_6, 7.0.76-12.el7_7, 7.0.76-15.el7
tomcat9 (Debian package) - update to 9.0.31-1~deb10u1
CF Deployment - update to 12.40.0
Cloud Foundry UAA - update to 74.16.0
tomcat - update to 7.0.99-1.el6

• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html
• https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E
• https://seclists.org/bugtraq/2019/Dec/43
• https://security.netapp.com/advisory/ntap-20200107-0001/
• https://www.debian.org/security/2019/dsa-4596

• Session fixation in Apache Tomcat
• OpenSUSE Linux update for tomcat
• Amazon Linux AMI update for tomcat8
• Gentoo update for Apache Tomcat
• Cloud Foundry UAA update for Apache Tomcat
• Multiple vulnerabilities in Oracle Database Server
• Session Fixation in MySQL Enterprise Monitor
• Multiple vulnerabilities in Instantis EnterpriseTrack
• Multiple vulnerabilities in Oracle Retail Order Broker
• Session Fixation in MICROS Relate CRM Software
• Debian update for tomcat9
• Red Hat Enterprise Linux 7 update for tomcat
• Multiple vulnerabilities in Hyperion Infrastructure Technology
• Session Fixation in Oracle Agile Engineering Data Management
• Red Hat Enterprise Linux 7.6 update for tomcat
• Red Hat Enterprise Linux 7.7 update for tomcat
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Session fixation in F5 BIG-IP Apache Tomcat component
• Fedora EPEL 6 update for tomcat