GHSA-4f7h-9j2x-cmr4
Improper Authentication in Apache Tomcat
At a glance
- Published
- Updated
- CVE
- CVE-2011-5062
Description
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 5.5.0, fixed 5.5.34 |
| Maven · org.apache.tomcat:tomcat | introduced 6.0.0, fixed 6.0.33 |
| Maven · org.apache.tomcat:tomcat | introduced 7.0.0, fixed 7.0.12 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-5062 ADVISORY
- https://github.com/apache/tomcat/commit/639e20992a66d7a42fb59c974db91c8a0f730a1e WEB
- https://github.com/apache/tomcat55/commit/644dfdf96cf82fcd2a2046d93f2b5495f7e94584 WEB
- https://access.redhat.com/errata/RHSA-2012:0074 WEB
- https://access.redhat.com/errata/RHSA-2012:0075 WEB
- https://access.redhat.com/errata/RHSA-2012:0076 WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E WEB
- https://web.archive.org/web/20151017023138/http://secunia.com/advisories/57126 WEB
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00002.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00006.html WEB
- http://marc.info/?l=bugtraq&m=139344343412337&w=2 WEB
- http://svn.apache.org/viewvc?view=rev&rev=1087655 WEB
- http://svn.apache.org/viewvc?view=rev&rev=1158180 WEB
- http://svn.apache.org/viewvc?view=rev&rev=1159309 WEB
- http://tomcat.apache.org/security-5.html WEB
- http://tomcat.apache.org/security-6.html WEB
- http://tomcat.apache.org/security-7.html WEB
- http://www.debian.org/security/2012/dsa-2401 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |