Skip to content
OpenAdvisories
Unscored RHSA-2013:0629 3 CVEs

Red Hat Security Advisory: jbossweb security update

Published Sep 15, 2024 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 jbossweb 0:2.1.13-3_patch_02.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 jbossweb-el-1.0-api 0:2.1.13-3_patch_02.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 jbossweb-jsp-2.1-api 0:2.1.13-3_patch_02.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 jbossweb-lib 0:2.1.13-3_patch_02.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 jbossweb-servlet-2.5-api 0:2.1.13-3_patch_02.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 jbossweb 0:2.1.13-3_patch_02.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 jbossweb-el-1.0-api 0:2.1.13-3_patch_02.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 jbossweb-jsp-2.1-api 0:2.1.13-3_patch_02.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 jbossweb-lib 0:2.1.13-3_patch_02.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 jbossweb-servlet-2.5-api 0:2.1.13-3_patch_02.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 jbossweb 0:2.1.13-4_patch_02.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 jbossweb-el-1.0-api 0:2.1.13-4_patch_02.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 jbossweb-jsp-2.1-api 0:2.1.13-4_patch_02.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 jbossweb-lib 0:2.1.13-4_patch_02.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 jbossweb-servlet-2.5-api 0:2.1.13-4_patch_02.ep5.el6

Vulnerabilities 3

  • Medium —
    CVE-2012-5885

    Improper Access Control in Apache Tomcat

    The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-5886

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass …

    org.apache.tomcat:tomcat-catalina Maven
  • Medium —
    CVE-2012-5887 EPSS 12%

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=873664
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0629.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-5885
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5885
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5885
  • report
    https://access.redhat.com/security/cve/CVE-2012-5886
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5886
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5886
  • report
    https://access.redhat.com/security/cve/CVE-2012-5887
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5887
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5887