Skip to content
OpenAdvisories
Unscored RHSA-2013:0640 4 CVEs

Red Hat Security Advisory: tomcat5 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 12

ReleasePackageFixed in
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-admin-webapps 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-common-lib 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-debuginfo 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-jasper 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-jasper-javadoc 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-jsp-2.0-api 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-jsp-2.0-api-javadoc 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-server-lib 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-servlet-2.4-api 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-servlet-2.4-api-javadoc 0:5.5.23-0jpp.38.el5_9
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-webapps 0:5.5.23-0jpp.38.el5_9

Vulnerabilities 4

  • Medium —
    CVE-2012-3546 EPSS 12%

    Authentication Bypass in Apache Tomcat

    org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-5885

    Improper Access Control in Apache Tomcat

    The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-5886

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass …

    org.apache.tomcat:tomcat-catalina Maven
  • Medium —
    CVE-2012-5887 EPSS 12%

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=873664
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=883634
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0640.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-3546
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-3546
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-3546
  • report
    https://access.redhat.com/security/cve/CVE-2012-5885
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5885
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5885
  • report
    https://access.redhat.com/security/cve/CVE-2012-5886
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5886
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5886
  • report
    https://access.redhat.com/security/cve/CVE-2012-5887
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5887
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5887