https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Doc Text *updated* by Timothy Walsh <twalsh(a)redhat.com> ---
When recycling the Request object to use for a new request, the requestedSessionSSL field
was not recycled. This meant that a session ID provided in the next request to be
processed using the recycled Request object could be used when it should not have been.
This gave the client the ability to control the session ID. In theory, this could have
been used as part of a session fixation attack but it would have been hard to achieve as
the attacker would not have been able to force the victim to use the 'correct'
Request object. It was also necessary for at least one web application to be configured to
use the SSL session ID as the HTTP session ID. This is not a common configuration.
--
You are receiving this mail because:
You are on the CC list for the bug.