Skip to content
OpenAdvisories
Unscored RHSA-2013:0623 5 CVEs

Red Hat Security Advisory: tomcat6 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-admin-webapps 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-docs-webapp 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-el-2.1-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-javadoc 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-jsp-2.1-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-lib 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-servlet-2.5-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-webapps 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-admin-webapps 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-docs-webapp 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-el-2.1-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-javadoc 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-jsp-2.1-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-lib 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-servlet-2.5-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-webapps 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-admin-webapps 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-docs-webapp 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-el-2.1-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-javadoc 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-jsp-2.1-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-lib 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-servlet-2.5-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-webapps 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-admin-webapps 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-docs-webapp 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-el-2.1-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-javadoc 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-jsp-2.1-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-lib 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-servlet-2.5-api 0:6.0.24-52.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-webapps 0:6.0.24-52.el6_4

Vulnerabilities 5

  • Medium —
    CVE-2012-3546 EPSS 12%

    Authentication Bypass in Apache Tomcat

    org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2012-4534

    org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO conn…

  • Medium —
    CVE-2012-5885

    Improper Access Control in Apache Tomcat

    The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-5886

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass …

    org.apache.tomcat:tomcat-catalina Maven
  • Medium —
    CVE-2012-5887 EPSS 12%

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    http://tomcat.apache.org/security-6.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=873664
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=883634
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=883637
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0623.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-3546
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-3546
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-3546
  • report
    https://access.redhat.com/security/cve/CVE-2012-4534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-4534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-4534
  • report
    https://access.redhat.com/security/cve/CVE-2012-5885
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5885
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5885
  • report
    https://access.redhat.com/security/cve/CVE-2012-5886
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5886
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5886
  • report
    https://access.redhat.com/security/cve/CVE-2012-5887
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5887
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5887