-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Tags: patch
See http://svn.apache.org/viewvc?view=revision&revision=1037779 (sorry for double mail to pkg-java list) On 2010-12-29 18:29, Giuseppe Iuculano wrote: > Package: tomcat6 > Severity: serious > Tags: security > > Hi, > the following CVE (Common Vulnerabilities & Exposures) id was > published for tomcat6. > > CVE-2010-4312[0]: > | The default configuration of Apache Tomcat 6.x does not include the > | HTTPOnly flag in a Set-Cookie header, which makes it easier for remote > | attackers to hijack a session via script access to a cookie. > > If you fix the vulnerability please also make sure to include the > CVE id in your changelog entry. > > For further information see: > > [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4312 > http://security-tracker.debian.org/tracker/CVE-2010-4312 > > __ This is the maintainer address of Debian's Java team <http://lists.alioth.debian.org/mailman/listinfo/pkg-java-maintainers>. Please use debian-j...@lists.debian.org for discussions and questions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCAAGBQJNG45bAAoJEAVLu599gGRCsJcP/R3YrrRytf8dwesNKXNo8Vcc 3HVxpbZ5Oz1lMK2djVEFzuyQNT9t7dTwCWDNj1ZL8XrOHDK6TOOcqXkRza8R/afM dr1D6z5bDon6nmuf0KwilgNTRGbs81/UQRvqd/sKFz0jCYcuCHMTNjBk3L7Z2FEH k5l1szLbxOAvzLlH6qMP1JnQ9YpPvHxTPNcBtIU9y1Aalx95pHvvYeuP2uUHi7pj HJEKS9KgwDXubkJxgxJ4Ktq/vQTyqgqzvw9auzDIBFt2d+PBX97BDNShDHTz+KMU 14VS/jBoN3vr6/S6k5gwPnqJewjWx/pXhKpZHHwGtyzsWrw/XzE0OICa1aimbS6F vWV5ySDih/touH1hq+yswmhjG+gNw5tJhXhZFrY2S/tt413AKj0/6OwfbhE385fj wlNPRfp7BYPUeAzwVazDIb1M/QFzt30LMbRlEhrvUx7IWREp3OzQHWejEdZvCLUr edsgHoSwfkY+F/IbyOhnOC4kUrmk5G8uwANiSxtuSET+eS60Zu/yRH5h+d48jYI+ zxFcP8qmEykC3+aLIuQmAa2b/w9i8eP+C1ON1+hfrCb0AzlDtfQcUw9nXkIeWhnE opI/myehgiDWH3EqtjudRNd/iYsV4judEAHmrZhhc7cZQeLrJgpCzjbrToZRKLta Qtw6KnJYFq5iYp0a0d9Y =Kiiq -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
