Secunia

A security issue has been reported in Apache Tomcat, which can be exploited by malicious people to disclose potentially sensitive information.

The security issue is caused due to an error when the SingleSignOn valve is configured to work over HTTPS. This can be exploited to potentially obtain the JSESSIONIDSSO cookie when transmitted over non encrypted HTTP channels.

The security issue is reported in version 5.5.20 and prior, and versions prior to 4.1.39 or 6.0.9.

Solution
Apache Tomcat 4.x:
Further details available in Customer Area

Provided and/or discovered by
Reported by Olaf Kock as an Apache bug.

Changelog
Further details available in Customer Area

Original Advisory
http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
http://tomcat.apache.org/security-4.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area