Description
Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | tomcat5.5 | 5.5.26-5lenny2 | DSA-2207-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 1 | ant | 1.7.1-13.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ant-commons-net | 1.7.1-14.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ant-jmf +16 | 1.7.1-13.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | antlr | 2.7.7-7.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | bcel | 5.2-8.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | cglib | 2.2-5.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | dom4j | 1.6.1-11.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ecj | 1:3.3.1.1-3.2.2.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | ecj3 | 1:3.3.1.1-3.1.1.1.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-jaf | 1.1.0-6.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-javamail | 1.4.2-0.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | glassfish-jsf | 1.2_13-2.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3 +1 | 1:3.3.2-1.4.GA_CP04.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-annotations +1 | 3.4.0-3.2.GA_CP04.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-commons-annotations +1 | 3.1.0-1.8.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-ejb-persistence-3.0-api +1 | 1:1.0.2-3.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | hibernate3-entitymanager +1 | 3.4.0-4.3.GA_CP04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd +2 | 2.2.17-11.1.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd-tools | 2.2.17-11.2.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | httpd22 +6 | 2.2.17-14.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-beanutils | 1.8.0-4.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-chain | 1.2-2.2.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-codec | 1.3-9.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-collections +1 | 3.2.1-4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-daemon | 1:1.0.5-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-daemon-jsvc | 1:1.0.5-1.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-dbcp +1 | 1.2.1-16.2.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-digester | 1.8.1-8.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-el | 1.0-19.2.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-fileupload | 1:1.1.1-7.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-httpclient | 1:3.1-1.1.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-io | 1.4-1.3.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-launcher | 1.1-4.6.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-logging +1 | 1.1.1-0.4.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-logging-jboss | 1.1-10.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-modeler | 2.0-4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-pool +1 | 1.3-11.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-commons-validator | 1.3.1-7.5.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-oro | 2.0.8-3.3.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jakarta-taglibs-standard | 1.1.1-9.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | javassist | 3.12.0-1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-common-core | 2.2.17-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-common-logging-jdk +1 | 2.1.2-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jboss-javaee +3 | 5.0.1-2.9.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jcommon | 1.0.16-1.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | jfreechart | 1.0.13-2.3.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | log4j | 1.2.14-18.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_cluster +5 | 1.0.10-2.GA_CP01.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_jk +2 | 1.2.31-1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_ssl | 1:2.2.17-11.1.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mod_ssl22 | 1:2.2.17-14.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | mx4j | 1:3.0.1-9.3.4.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | objectweb-asm | 3.1-5.3.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | objectweb-asm31 | 3.1-12.1.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | regexp | 1.5-1.2.1.jdk6.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | struts12 | 1.2.9-3.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat-jkstatus-ant | 1.2.31-2.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat-native | 1.1.20-2.0.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat5 +12 | 5.5.33-14_patch_04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.32-14_patch_03.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xalan-j2 | 2.7.1-5.3_patch_04.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xerces-j2 | 2.9.1-3.patch01.1.ep5.el4 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xml-commons +3 | 1.3.04-7.10.jdk6.ep5.el5 | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1 | xml-commons-which10 +4 | 1.3.04-7.14.ep5.el6 | RHSA-2011:0897 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP14.0jpp.ep1.1.el4 | RHSA-2010:0584 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure EDB-12343 · remote · Apr 22, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.30 | 5.5.30 | GHSA-w6q7-ww2x-7gm3 |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.28 | 6.0.28 | GHSA-w6q7-ww2x-7gm3 |
Advisories 3
- RHSA-2011:0897 Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0584 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-2207-1 tomcat5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20100421 [SECURITY] CVE-2010-1157: Apache Tomcat information disclosure vulnerability mailing-list
- DSA-2207 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=936540
- HPSBUX02860 vendor-advisory
- MDVSA-2010:177 vendor-advisory
- ADV-2010-3056 vdb-entry
- 43310 third-party-advisory
- 39574 third-party-advisory
- HPSBOV02762 vendor-advisory
- APPLE-SA-2011-10-12-3 vendor-advisory
- MDVSA-2010:176 vendor-advisory
- 42368 third-party-advisory
- RHSA-2011:0897 vendor-advisory
- ADV-2010-0980 vdb-entry
- oval:org.mitre.oval:def:19492 vdb-entry signature
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- http://svn.apache.org/viewvc?view=revision&revision=936541
- SUSE-SR:2010:017 vendor-advisory
- 39635 vdb-entry
- RHSA-2011:0896 vendor-advisory
- http://tomcat.apache.org/security-5.html
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- HPSBUX02579 vendor-advisory
- http://support.apple.com/kb/HT5002
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- HPSBST02955 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list