Description
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | tomcat6 +8 | 6.0.24-52.el6_4 | RHSA-2013:0623 |
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.38.el5_9 | RHSA-2013:0640 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 2 | tomcat6 +9 | 6.0.35-6_patch_06.ep6.el5 | RHSA-2013:0266 |
| Red Hat JBoss Web Platform 5 | jbossweb +4 | 2.1.13-3_patch_02.ep5.el5 | RHSA-2013:0631 |
| Red Hat JBoss EAP 6 | jbossweb +1 | 7.0.17-4.Final_redhat_3.ep6.el5 | RHSA-2013:0647 |
| Red Hat JBoss EAP 5 | jbossweb +4 | 2.1.13-3_patch_02.ep5.el4 | RHSA-2013:0629 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat-catalina | >= 5.5.0, < 5.5.36 | 5.5.36 | GHSA-9xrj-439h-62hg |
| Maven | org.apache.tomcat:tomcat-catalina | >= 6.0.0, < 6.0.36 | 6.0.36 | GHSA-9xrj-439h-62hg |
| Maven | org.apache.tomcat:tomcat-catalina | >= 7.0.0, < 7.0.30 | 7.0.30 | GHSA-9xrj-439h-62hg |
Advisories 6
- RHSA-2013:0647 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0640 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0631 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0623 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0629 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0266 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21626891
- 51371 third-party-advisory
- openSUSE-SU-2012:1700 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1392248
- RHSA-2013:0631 vendor-advisory
- RHSA-2013:0640 vendor-advisory
- USN-1637-1 vendor-advisory
- 56403 vdb-entry
- http://tomcat.apache.org/security-7.html
- RHSA-2013:0648 vendor-advisory
- tomcat-http-Digest-security-bypass(80407) vdb-entry
- RHSA-2013:0633 vendor-advisory
- RHSA-2013:0629 vendor-advisory
- RHSA-2013:0647 vendor-advisory
- RHSA-2013:0632 vendor-advisory
- http://tomcat.apache.org/security-6.html
- http://svn.apache.org/viewvc?view=revision&revision=1380829
- openSUSE-SU-2013:0147 vendor-advisory
- RHSA-2013:0623 vendor-advisory
- http://tomcat.apache.org/security-5.html
- http://svn.apache.org/viewvc?view=revision&revision=1377807
- openSUSE-SU-2012:1701 vendor-advisory
- RHSA-2013:0726 vendor-advisory