Red Hat Security Advisory

RHSA-2013:0266

tomcat6 security update

Released 2013-02-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat6-6.0.35-6_patch_06.ep6.el5, tomcat6-admin-webapps-6.0.35-6_patch_06.ep6.el5, tomcat6-docs-webapp-6.0.35-6_patch_06.ep6.el5 +7
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat6-6.0.35-29_patch_06.ep6.el6, tomcat6-admin-webapps-6.0.35-29_patch_06.ep6.el6, tomcat6-docs-webapp-6.0.35-29_patch_06.ep6.el6 +7

Fixes 6 records

TI-2012-04911 CVE-2012-5886 · GHSA-9xrj-439h-62hg

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before…

MEDIUM 40

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08768 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-287

TI-2012-03773 CVE-2012-4431 · GHSA-76vr-72mv-mf3q

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36…

LOW 38

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request th…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09146 Published 2012-12-19 Partial fix · 6.0.36, 7.0.32 CWE-264

TI-2012-04912 CVE-2012-5887 · GHSA-28cq-6rmx-pjq4

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before…

LOW 37

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.12098 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-287

TI-2012-04910 CVE-2012-5885 · GHSA-99rf-92v6-cwx4

The replay-countermeasure functionality in the HTTP Digest Access Authentication…

LOW 34

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values inste…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0898 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-264

TI-2012-02364 CVE-2012-2733 · GHSA-cpr9-82wf-f629

java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in…

LOW 34

java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attacke…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08742 Published 2012-11-16 Fixed CWE-20

TI-2012-03874 CVE-2012-4534 · GHSA-pxwv-88pv-hh3j

org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x…

LOW 30

org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of se…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.07452 Published 2012-12-19 Fixed CWE-399