https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Doc Text *updated* by Martin Prpic <mprpic(a)redhat.com> ---
A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL
field. If at least one web application was configured to use the SSL session ID as the
HTTP session ID, an attacker could reuse a previously used session ID for further
requests.
--
You are receiving this mail because:
You are on the CC list for the bug.