CVE-2013-2067 — Improper Authentication in Apache Tomcat

Description

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 7	tomcat6	6.0.35-6+deb7u1	DSA-2725-1
Debian 7	tomcat7	7.0.28-4+deb7u1	DSA-2897-1
Debian 6.0	tomcat6	6.0.35-1+squeeze3	DSA-2725-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 6	tomcat6 +8	6.0.24-57.el6_4	RHSA-2013:0964

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 2	apache-commons-daemon-eap6	1:1.0.15-4.redhat_1.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	apache-commons-daemon-jsvc-eap6	1:1.0.15-1.redhat_1.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	apache-commons-pool-eap6 +1	1.6-6.redhat_4.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	dom4j	1.6.1-19.redhat_5.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	ecj3	1:3.7.2-6.redhat_1.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	httpd +3	2.2.22-23.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	mod_cluster +3	1.2.4-1.Final_redhat_1.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	mod_cluster-native	1.2.4-1.Final.redhat_1.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	mod_jk +2	1.2.37-2.redhat_1.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	mod_ssl	1:2.2.22-23.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	tomcat-native	1.1.27-4.redhat_1.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	tomcat6 +9	6.0.37-8_patch_01.ep6.el5	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss Web Server 2	tomcat7 +9	7.0.40-5_patch_01.ep6.el6	RHSA-2013:1012, RHSA-2013:1011
Red Hat JBoss EAP 6	apache-commons-daemon-eap6	1:1.0.15-4.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	apache-commons-daemon-jsvc-eap6	1:1.0.15-1.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	apache-commons-pool-eap6	1.6-6.redhat_4.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	apache-cxf	2.6.6-20.redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	atinject	1-9.redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	atinject-eap6	1-3.redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-4.redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	cxf-xjc-dv +3	2.6.0-1.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	dom4j +1	1.6.1-19.redhat_5.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	ecj3	1:3.7.2-6.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	glassfish-javamail	1.4.5-1.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	glassfish-jaxb +1	2.2.5-14.redhat_5.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	glassfish-jsf	2.1.19-2.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	glassfish-jsf12	1.2_15-12_b01_redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	guava +1	13.0.1-1.redhat_1.ep6.el5.1	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	h2database	1.3.168-3_redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	hibernate4 +4	4.2.0-3.Final_redhat_1.ep6.el6	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	hibernate4-validator	4.3.1-1.Final_redhat_1.1.ep6.el5.5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	hornetq +2	2.3.1-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	httpcomponents +1	6-7.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	httpcore +4	4.2.1-7.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	httpd +2	2.2.22-18.ep6.el6	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	infinispan +4	5.2.6-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	ironjacamar	1.0.17-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jacorb-jboss	2.3.2-11.redhat_4.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jansi	1.9-2.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jaxbintros	1.0.2-14.GA_redhat_4.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbosgi-deployment	1.3.0-2.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbosgi-framework-core	2.1.0-2.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbosgi-metadata	2.2.0-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbosgi-resolver	3.0.1-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbosgi-spi	3.2.0-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbosgi-vfs	1.2.1-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-aesh	0.33.3-1_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-as-console	1.5.2-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-as-ee +59	7.2.0-8.Final_redhat_8.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-common-beans +2	1.1.0-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-dmr	1.1.6-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.21-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-jaxrpc-api_1.1_spec	1.0.1-4.Final_redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-jaxrs-api_1.1_spec	1.0.1-7.Final_redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-jms-api_1.1_spec +1	1.0.1-6.Final_redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-jsf-api_2.1_spec	2.1.19.1-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-logmanager	1.4.0-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-marshalling	1.3.16-.GA.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-metadata +5	7.0.8-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-modules	1.2.0-2.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-msc	1.0.4-1.GA_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-remote-naming	1.0.6-2.Final_redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-remoting3	3.2.16-1.GA_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-security-negotiation	2.2.5-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-servlet-api_3.0_spec	1.0.2-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jboss-threads +1	2.1.0-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbossas-javadocs	7.2.0-7.Final_redhat_7.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbossts	1:4.17.4-3.Final_redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbossweb	7.2.0-2.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbossws-api	1.0.1-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbossws-common	2.1.1-1.Final_redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbossws-cxf	4.1.3-1.Final_redhat_3.ep6.el5.2	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbossws-native	4.1.1-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jbossws-spi	2.1.2-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jcip-annotations	1.0-3.redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jcip-annotations-eap6	1.0-3.1.redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jgroups	1:3.2.7-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	joda-time	1.6.2-5.redhat_4.ep6.el5.5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	jul-to-slf4j-stub	1.0.1-1.Final_redhat_1.1.ep6.el5.2	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	mod_cluster +1	1.2.4-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	mod_cluster-native	1.2.4-1.Final.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	mod_jk +1	1.2.37-2.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	mod_ssl	1:2.2.22-18.ep6.el6	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	netty	3.6.2-1_redhat_1.1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	objectweb-asm-eap6	3.3.1-6.2.redhat_4.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	opensaml	2.5.1-1.redhat_1.ep6.el5.2	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	openws	1.4.2-9_redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	org.osgi +2	4.2.0-9.redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	picketbox	4.0.17-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	picketlink-federation	2.1.6-3.Final_redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	relaxngDatatype +1	2011.1-4.redhat_6.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	resteasy	2.3.6-1.Final_redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	slf4j +1	1.7.2-10.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	slf4j-jboss-logmanager	1.0.2-1.GA_redhat_1.3.ep6.el5.2	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	sun-ws-metadata-2.0-api	1.0.MR1-12_MR1_redhat_3.ep6.el5.5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	tomcat-native +1	1.1.27-4.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	velocity-eap6	1.7-2.1.redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	weld-cdi-1.0-api	1.0-8.SP4_redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	weld-core	1.1.13-1.Final_redhat_1.ep6.el5.1	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	woodstox-core	4.2.0-7.redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	woodstox-core-asl	4.2.0-7.redhat_2.ep6.el6	RHSA-2013:0834
Red Hat JBoss EAP 6	woodstox-stax2-api	3.1.1-7.redhat_3.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	wsdl4j-eap6	1.6.2-12.3.redhat_4.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	wss4j	1.6.9-2.redhat_2.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	xerces-j2-eap6	2.9.1-14_redhat_4.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	xml-commons-resolver-eap6	1.2-10.redhat_3.ep6.el5.4	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	xml-security	1.5.3-1.redhat_1.ep6.el5	RHSA-2013:0839, RHSA-2013:0834
Red Hat JBoss EAP 6	xmltooling	1.3.2-10.redhat_4.ep6.el5	RHSA-2013:0839, RHSA-2013:0834

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat	>= 6.0.21, < 6.0.37	6.0.37	GHSA-6m48-jxwx-76q7
Maven	org.apache.tomcat:tomcat	>= 7.0.0, < 7.0.33	7.0.33	GHSA-6m48-jxwx-76q7

Advisories 7

RHSA-2013:1012 Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:1011 Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0964 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0839 Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:0834 Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
DSA-2725-1 tomcat6 - several Debian Security (DSA / DLA) · Mar 9, 2026
DSA-2897-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026

References

RHSA-2013:0839 vendor-advisory
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java?r1=1417891&r2=1417890&pathrev=1417891
RHSA-2013:0964 vendor-advisory
http://svn.apache.org/viewvc?view=revision&revision=1417891
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java?r1=1408044&r2=1408043&pathrev=1408044
http://tomcat.apache.org/security-7.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
RHSA-2013:0833 vendor-advisory
http://svn.apache.org/viewvc?view=revision&revision=1408044
RHSA-2013:1437 vendor-advisory
http://tomcat.apache.org/security-6.html
59799 vdb-entry
USN-1841-1 vendor-advisory
RHSA-2013:0834 vendor-advisory
64758 vdb-entry
20130510 [SECURITY] CVE-2013-2067 Session fixation with FORM authenticator mailing-list
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list