Red Hat Security Advisory

RHSA-2013:0647

jbossweb security update

Released 2013-03-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server jbossweb-7.0.17-4.Final_redhat_3.ep6.el5, jbossweb-lib-7.0.17-4.Final_redhat_3.ep6.el5
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server jbossweb-7.0.17-4.Final_redhat_3.ep6.el6, jbossweb-lib-7.0.17-4.Final_redhat_3.ep6.el6

Fixes 4 records

TI-2012-04911 CVE-2012-5886 · GHSA-9xrj-439h-62hg

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before…

MEDIUM 40

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08768 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-287

TI-2012-03773 CVE-2012-4431 · GHSA-76vr-72mv-mf3q

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36…

LOW 38

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request th…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09146 Published 2012-12-19 Partial fix · 6.0.36, 7.0.32 CWE-264

TI-2012-04912 CVE-2012-5887 · GHSA-28cq-6rmx-pjq4

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before…

LOW 37

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.12098 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-287

TI-2012-04910 CVE-2012-5885 · GHSA-99rf-92v6-cwx4

The replay-countermeasure functionality in the HTTP Digest Access Authentication…

LOW 34

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values inste…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0898 Published 2012-11-17 Partial fix · 5.5.36, 6.0.36 +1 CWE-264