This advisory addresses a session fixation vulnerability in Apache Tomcat's rewrite valve, which is part of the Red Hat Hardened Images RPMs for tomcat10. When the rewrite valve is enabled, an attacker can craft a URL that fixes the victim's session ID to one controlled by the attacker. This enables the attacker to hijack the victim's session and perform actions on their behalf. Red Hat has assigned a high severity rating but currently does not provide an official fix or mitigation that meets their standards for ease of use, applicability, or stability. The advisory references multiple CVEs related to this update and includes several tomcat10 RPM packages. The vulnerability is tracked as CWE-384 (Session Fixation).

Successful exploitation allows an attacker to hijack a victim's session by forcing the victim to use a session ID chosen by the attacker. This compromises confidentiality by allowing unauthorized access to the victim's session context. Integrity and availability impacts are not indicated. The vulnerability requires user interaction (clicking a crafted URL) and the rewrite valve must be enabled in the affected Tomcat instance.

Currently, no mitigation or patch meeting Red Hat Product Security criteria is available. Users should consider disabling the rewrite valve if feasible or apply other environment-specific mitigations. Monitoring Red Hat advisories for future updates or fixes is recommended. Customers with a Red Hat Technical Account Manager (TAM) can seek direct guidance. Upgrading to a supported product version with a fix, once available, is advised.