Read the docs
Red Hat Security Advisory

RHSA-2013:0632

jbossweb security update

Released 2013-03-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 3 records

TI-2012-04911 CVE-2012-5886 · GHSA-9xrj-439h-62hg

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before…

Priority MEDIUM 40

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08768 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-287
TI-2012-04912 CVE-2012-5887 · GHSA-28cq-6rmx-pjq4

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before…

Priority LOW 37

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.12098 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-287
TI-2012-04910 CVE-2012-5885 · GHSA-99rf-92v6-cwx4

The replay-countermeasure functionality in the HTTP Digest Access Authentication…

Priority LOW 34

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values inste…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0898 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-264