Read the docs
Red Hat Security Advisory

RHSA-2013:0640

tomcat5 security update

Released 2013-03-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 4 records

TI-2012-04911 CVE-2012-5886 · GHSA-9xrj-439h-62hg

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before…

Priority MEDIUM 40

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08768 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-287
TI-2012-04912 CVE-2012-5887 · GHSA-28cq-6rmx-pjq4

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before…

Priority LOW 37

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.12098 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-287
TI-2012-04910 CVE-2012-5885 · GHSA-99rf-92v6-cwx4

The replay-countermeasure functionality in the HTTP Digest Access Authentication…

Priority LOW 34

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values inste…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0898 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-264
TI-2012-03071 CVE-2012-3546 · GHSA-jgm2-m5cg-f66g

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x…

Priority LOW 34

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous s…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.11975 Published 2012-12-19 Partial fix · 6.0.36, 7.0.30 CWE-264