Apache disclosed a new Tomcat vulnerability: CVE-2023-28708
Affected Tomcat versions are 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85
API Gateway 10.1 and 11.0 include Tomcat version 9.0.62 library which is in the range of vulnerable versions.
Release : 10.1
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
API Gateway don't use vulnerable class "RemoteIpFilter", hence CVE-2023-28708 does not affect our product.