Red Hat Security AdvisoryRHSA-2013:0623
tomcat6 security update
Released 2013-03-11 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-52.el6_4, tomcat6-admin-webapps-6.0.24-52.el6_4, tomcat6-docs-webapp-6.0.24-52.el6_4 +6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-52.el6_4, tomcat6-admin-webapps-6.0.24-52.el6_4, tomcat6-docs-webapp-6.0.24-52.el6_4 +6
- Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-52.el6_4, tomcat6-el-2.1-api-6.0.24-52.el6_4, tomcat6-jsp-2.1-api-6.0.24-52.el6_4 +2
- Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-52.el6_4, tomcat6-admin-webapps-6.0.24-52.el6_4, tomcat6-docs-webapp-6.0.24-52.el6_4 +2
- Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-52.el6_4, tomcat6-el-2.1-api-6.0.24-52.el6_4, tomcat6-jsp-2.1-api-6.0.24-52.el6_4 +2
- Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-52.el6_4, tomcat6-admin-webapps-6.0.24-52.el6_4, tomcat6-docs-webapp-6.0.24-52.el6_4 +2
Fixes 5 records
Priority MEDIUM 40
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.08768 · Published 2012-11-17 · Partial fix · 5.5.36, 6.0.36 +1 CWE-287
Priority LOW 37
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.12098 · Published 2012-11-17 · Partial fix · 5.5.36, 6.0.36 +1 CWE-287
Priority LOW 34
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values inste…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.0898 · Published 2012-11-17 · Partial fix · 5.5.36, 6.0.36 +1 CWE-264
Priority LOW 34
org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous s…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.11975 · Published 2012-12-19 · Partial fix · 6.0.36, 7.0.30 CWE-264
Priority LOW 30
org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of se…
CVSS 2.0LOW 2.6· Network · No auth · Interaction — · EPSS 0.07452 · Published 2012-12-19 · Fixed CWE-399
THREATIST.IORead the docs