Skip to content
OpenAdvisories
Unscored RHSA-2013:0647 4 CVEs

Red Hat Security Advisory: jbossweb security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossweb 0:7.0.17-4.Final_redhat_3.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossweb-lib 0:7.0.17-4.Final_redhat_3.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jbossweb 0:7.0.17-4.Final_redhat_3.ep6.el6
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jbossweb-lib 0:7.0.17-4.Final_redhat_3.ep6.el6

Vulnerabilities 4

  • Medium —
    CVE-2012-4431 Public exploit

    Cross-Site Request Forgery in Apache Tomcat

    org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-5885

    Improper Access Control in Apache Tomcat

    The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-5886

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass …

    org.apache.tomcat:tomcat-catalina Maven
  • Medium —
    CVE-2012-5887 EPSS 12%

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=873664
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=883636
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0647.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-4431
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-4431
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-4431
  • article
    http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.32
  • report
    https://access.redhat.com/security/cve/CVE-2012-5885
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5885
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5885
  • report
    https://access.redhat.com/security/cve/CVE-2012-5886
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5886
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5886
  • report
    https://access.redhat.com/security/cve/CVE-2012-5887
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-5887
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-5887