GHSA-28cq-6rmx-pjq4
Improper Authentication in Apache Tomcat
At a glance
- Published
- Updated
- CVE
- CVE-2012-5887
Description
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 5.5.0, fixed 5.5.36 |
| Maven · org.apache.tomcat:tomcat | introduced 6.0.0, fixed 6.0.36 |
| Maven · org.apache.tomcat:tomcat | introduced 7.0.0, fixed 7.0.30 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-5887 ADVISORY
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79809 WEB
- https://github.com/apache/tomcat PACKAGE
- http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html WEB
- http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html WEB
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0623.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0629.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0631.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0632.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0640.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0647.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0648.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0726.html WEB
- http://svn.apache.org/viewvc?view=revision&revision=1377807 WEB
- http://svn.apache.org/viewvc?view=revision&revision=1380829 WEB
- http://svn.apache.org/viewvc?view=revision&revision=1392248 WEB
- http://tomcat.apache.org/security-5.html WEB
- http://tomcat.apache.org/security-6.html WEB
- http://tomcat.apache.org/security-7.html WEB
- http://www-01.ibm.com/support/docview.wss?uid=swg21626891 WEB
- http://www.ubuntu.com/usn/USN-1637-1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |