Broadcom API Gateway - Apache Tomcat vulnerability CVE-2023-28708

Products

• CA API Gateway

Issue/Introduction

Apache disclosed a new Tomcat vulnerability: CVE-2023-28708

Affected Tomcat versions are 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85

API Gateway 10.1 and 11.0 include Tomcat version 9.0.62 library which is in the range of vulnerable versions.

 

 

Environment

Release : 10.1

Cause

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-28708

 

Resolution

API Gateway don't use vulnerable class "RemoteIpFilter", hence CVE-2023-28708 does not affect our product.