CVE-2012-3546 — Authentication Bypass in Apache Tomcat

Description

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 6	tomcat6 +8	6.0.24-52.el6_4	RHSA-2013:0623
RHEL 5	tomcat5 +10	5.5.23-0jpp.38.el5_9	RHSA-2013:0640

Show 6 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 2	tomcat6 +9	6.0.35-6_patch_02.ep6.el5	RHSA-2013:0005
Red Hat JBoss Web Server 1	tomcat5 +12	5.5.33-31_patch_08.ep5.el5	RHSA-2013:0641
Red Hat JBoss Web Server 1	tomcat6 +9	6.0.32-28_patch_08.ep5.el5	RHSA-2013:0158
Red Hat JBoss Web Platform 5	aopalliance	1.0-5.2.jdk6.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	apache-cxf	2.2.12-6.1.patch_04.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	bsh2 +1	2.0-0.b4.15.patch01.ep5.el6	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	glassfish-jaxb	2.1.12-12_patch_03.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	google-guice	2.0-3.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	hibernate3 +1	1:3.3.2-1.5.GA_CP05.ep5.el5	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	hibernate3-annotations +1	3.4.0-3.3.GA_CP05.ep5.el5	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	hibernate3-entitymanager +1	3.4.0-4.4.GA_CP05.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	hibernate3-search +1	3.1.1-2.3.GA_CP05.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	hsqldb	2:1.8.0.10-11_patch_01.1.ep5.el6	RHSA-2013:0195
Red Hat JBoss Web Platform 5	jacorb-jboss	2.3.2-2.jboss_1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	javassist	3.12.0-6.SP1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-aop2	2.1.6-5.CP06.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-bootstrap	1.0.2-1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-cache-core	3.2.11-1.GA.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-cache-pojo	3.0.1-1.ep5.el6	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-cl	2.0.11-1.GA.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-cluster-ha-server-api	1.2.1-2.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-common-beans	1.0.1-2.Final.ep5.el6	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-common-core	2.2.21-1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-eap5-native	5.2.0-6.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-cache	1.0.0-4.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-core	1.3.9-0.4.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-ext-api	1.0.0-4.1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-ext-api-impl	1.0.0-3.7.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-interceptors	1.0.9-0.1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-metadata	1.0.0-3.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-metrics-deployer	1.1.1-0.1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-security	1.0.2-0.5.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-timeout +2	0.1.1-0.5.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-ejb3-transactions	1.0.2-1.4.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-javaee +8	5.0.2-2.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-jaxrpc-api_1.1_spec	1.0.0-16.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-jpa-deployers	1.0.0-6.SP2.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-logmanager	1.1.2-6.GA_patch_01.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-naming	5.0.3-5.CP02.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-reflect	2.0.4-2.ep5.el6	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-remoting	2.5.4-10.SP4.1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-seam2 +3	2.2.6.EAP5-9.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-security-negotiation	2.1.3-1.GA.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-security-spi	1:2.0.5-4.SP3_1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jboss-vfs2	2.2.1-2.GA.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbossas-web +3	5.2.0-7.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbossas-ws-cxf-ewp	5.2.0-7.ep5.el5	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbosssx2	2.0.5-8.SP3_1.ep5.el5	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbossts +1	1:4.6.1-12.CP13.7.ep5.el6	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbossweb +4	2.1.13-2_patch_01.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbossws	3.1.2-13.SP15_patch_01.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbossws-common	1.1.0-9.SP10.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbossws-framework	3.1.2-9.SP13.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jbossws-spi	1.1.2-6.SP8.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jgroups	1:2.6.22-1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jopr-embedded	1.3.4-19.SP6.9.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jopr-hibernate-plugin	3.0.0-14.EmbJopr5.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	jopr-jboss-cache-v3-plugin	3.0.0-15.EmbJopr5.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	mod_cluster +4	1.0.10-12.2.GA_CP04.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	mod_cluster-native	1.0.10-10.GA_CP04_patch01.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	picketlink-federation	2.1.5-3.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	picketlink-quickstarts +3	2.1.5-1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	resteasy +3	1.2.1-17.CP02_patch02.1.ep5.el6	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	rh-ewp-docs +1	5.2.0-6.ep5.el5	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	rhq +14	3.0.0-21.EmbJopr5.ep5.el5	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	rhq-helpers +8	3.0.0-21.EmbJopr5.ep5.el6	RHSA-2013:0195
Red Hat JBoss Web Platform 5	rhq-jmx-plugin	3.0.0-21.EmbJopr5.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	rhq-platform-plugin +1	3.0.0-14.EmbJopr5.ep5.el5	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	spring2 +6	2.5.6-9.SEC03.1.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	wss4j	1.5.12-4_patch_02.ep5.el6	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	xerces-j2 +1	2.9.1-10.patch02.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	xml-commons +8	1.3.04-8.2_patch_01.ep5.el5	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss Web Platform 5	xml-security	1.5.1-2.ep5.el4	RHSA-2013:0197, RHSA-2013:0196, RHSA-2013:0195
Red Hat JBoss EAP 6	jbossweb +1	7.0.17-3.Final_redhat_2.ep6.el5	RHSA-2013:0164
Red Hat JBoss EAP 5	aopalliance	1.0-5.2.jdk6.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	apache-cxf	2.2.12-6.1.patch_04.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	bsh2 +1	2.0-0.b4.15.patch01.ep5.el6	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	glassfish-jaxb	2.1.12-12_patch_03.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	google-guice	2.0-3.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	hibernate3 +1	1:3.3.2-1.5.GA_CP05.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	hibernate3-annotations +1	3.4.0-3.3.GA_CP05.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	hibernate3-entitymanager +1	3.4.0-4.4.GA_CP05.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	hibernate3-search +1	3.1.1-2.3.GA_CP05.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	hornetq	2.2.24-1.EAP.GA.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	hornetq-native	2.2.20-1.EAP.GA.ep5.el6	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	hsqldb	2:1.8.0.10-11_patch_01.1.ep5.el6	RHSA-2013:0191
Red Hat JBoss EAP 5	jacorb-jboss	2.3.2-2.jboss_1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	javassist	3.12.0-6.SP1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-aop2	2.1.6-5.CP06.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-bootstrap	1.0.2-1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-cache-core	3.2.11-1.GA.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-cache-pojo	3.0.1-1.ep5.el6	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-cl	2.0.11-1.GA.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-cluster-ha-server-api	1.2.1-2.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-common-beans	1.0.1-2.Final.ep5.el6	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-common-core	2.2.21-1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-eap5-native	5.2.0-6.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-cache	1.0.0-4.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-core	1.3.9-0.4.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-ext-api	1.0.0-4.1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-ext-api-impl	1.0.0-3.7.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-interceptors	1.0.9-0.1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-metadata	1.0.0-3.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-metrics-deployer	1.1.1-0.1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-security	1.0.2-0.5.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-timeout +2	0.1.1-0.5.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-ejb3-transactions	1.0.2-1.4.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-javaee +8	5.0.2-2.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-jaxrpc-api_1.1_spec	1.0.0-16.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-jpa-deployers	1.0.0-6.SP2.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-logmanager	1.1.2-6.GA_patch_01.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-messaging	1.4.8-12.SP9.1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-naming	5.0.3-5.CP02.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-reflect	2.0.4-2.ep5.el6	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-remoting	2.5.4-10.SP4.1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-seam2 +3	2.2.6.EAP5-9.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-security-negotiation	2.1.3-1.GA.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-security-spi	1:2.0.5-4.SP3_1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jboss-vfs2	2.2.1-2.GA.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossas +3	5.2.0-14.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossas-hornetq	5.2.0-5.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossas-tp-licenses	5.2.0-7.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossas-ws-cxf	5.2.0-7.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbosssx2	2.0.5-8.SP3_1.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossts +1	1:4.6.1-12.CP13.7.ep5.el6	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossweb +4	2.1.13-2_patch_01.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossws	3.1.2-13.SP15_patch_01.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossws-common	1.1.0-9.SP10.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossws-framework	3.1.2-9.SP13.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jbossws-spi	1.1.2-6.SP8.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jgroups	1:2.6.22-1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jopr-embedded	1.3.4-19.SP6.9.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jopr-hibernate-plugin	3.0.0-14.EmbJopr5.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	jopr-jboss-cache-v3-plugin	3.0.0-15.EmbJopr5.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	mod_cluster +4	1.0.10-12.2.GA_CP04.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	mod_cluster-native	1.0.10-10.GA_CP04_patch01.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	netty	3.2.5-6.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	picketlink-federation	2.1.5-3.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	picketlink-quickstarts +3	2.1.5-1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	resteasy +3	1.2.1-17.CP02_patch02.1.ep5.el6	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	rh-eap-docs +1	5.2.0-6.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	rhq +23	3.0.0-21.EmbJopr5.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	rhq-jmx-plugin	3.0.0-21.EmbJopr5.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	rhq-platform-plugin +1	3.0.0-14.EmbJopr5.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	spring2 +6	2.5.6-9.SEC03.1.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	wss4j	1.5.12-4_patch_02.ep5.el6	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	xerces-j2	2.9.1-10.patch02.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	xerces-j2-scripts	2.9.1-10.patch02.ep5.el5	RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	xml-commons +8	1.3.04-8.2_patch_01.ep5.el5	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 5	xml-security	1.5.1-2.ep5.el4	RHSA-2013:0193, RHSA-2013:0192, RHSA-2013:0191
Red Hat JBoss EAP 4	jbossas +1	4.3.0-11.GA_CP10_patch_02.1.ep1.el4	RHSA-2013:0147

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat	>= 6.0.0, < 6.0.36	6.0.36	GHSA-jgm2-m5cg-f66g
Maven	org.apache.tomcat:tomcat	>= 7.0.0, < 7.0.30	7.0.30	GHSA-jgm2-m5cg-f66g

Advisories 13

RHSA-2013:0641 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0640 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0623 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0197 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0196 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0195 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0192 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0193 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0191 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0158 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0164 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0147 Red Hat Security Advisory: jbossas security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0005 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026

References

SSRT101139 vendor-advisory
1027833 vdb-entry
USN-1685-1 vendor-advisory
56812 vdb-entry
openSUSE-SU-2012:1700 vendor-advisory
http://svn.apache.org/viewvc?view=revision&revision=1377892
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/realm/RealmBase.java?r1=1377892&r2=1377891&pathrev=1377892
RHSA-2013:0640 vendor-advisory
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1377892&r2=1377891&pathrev=1377892
RHSA-2013:0163 vendor-advisory
SSRT101182 vendor-advisory
RHSA-2013:0164 vendor-advisory
RHSA-2013:0192 vendor-advisory
RHSA-2013:0198 vendor-advisory
RHSA-2013:0641 vendor-advisory
20121204 CVE-2012-3546 Apache Tomcat Bypass of security constraints mailing-list
http://tomcat.apache.org/security-7.html
RHSA-2013:0004 vendor-advisory
RHSA-2013:0195 vendor-advisory
RHSA-2013:0221 vendor-advisory
RHSA-2013:0196 vendor-advisory
RHSA-2013:0147 vendor-advisory
oval:org.mitre.oval:def:19305 vdb-entry signature
RHSA-2013:0158 vendor-advisory
RHSA-2013:0193 vendor-advisory
RHSA-2013:0157 vendor-advisory
51984 third-party-advisory
http://tomcat.apache.org/security-6.html
52054 third-party-advisory
57126 third-party-advisory
RHSA-2013:0146 vendor-advisory
openSUSE-SU-2013:0147 vendor-advisory
RHSA-2013:0191 vendor-advisory
RHSA-2013:0623 vendor-advisory
RHSA-2013:0197 vendor-advisory
RHSA-2013:0235 vendor-advisory
RHSA-2013:0642 vendor-advisory
RHSA-2013:0194 vendor-advisory
RHSA-2013:0005 vendor-advisory
HPSBST02955 vendor-advisory
openSUSE-SU-2012:1701 vendor-advisory
RHSA-2013:0162 vendor-advisory
RHSA-2013:0151 vendor-advisory