GHSA-9xrj-439h-62hg

Improper Authentication in Apache Tomcat

At a glance

Published: 2022-05-17 01:38 UTC
Updated: 2024-11-29 05:41 UTC
CVE: CVE-2012-5886

Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Affected packages

Package	Versions
Maven · org.apache.tomcat:tomcat-catalina	introduced 5.5.0, fixed 5.5.36
Maven · org.apache.tomcat:tomcat-catalina	introduced 6.0.0, fixed 6.0.36
Maven · org.apache.tomcat:tomcat-catalina	introduced 7.0.0, fixed 7.0.30

References

https://nvd.nist.gov/vuln/detail/CVE-2012-5886 ADVISORY
https://exchange.xforce.ibmcloud.com/vulnerabilities/80407 WEB
http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html WEB
http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html WEB
http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html WEB
http://rhn.redhat.com/errata/RHSA-2013-0623.html WEB
http://rhn.redhat.com/errata/RHSA-2013-0629.html WEB
http://rhn.redhat.com/errata/RHSA-2013-0631.html WEB
http://rhn.redhat.com/errata/RHSA-2013-0632.html WEB
http://rhn.redhat.com/errata/RHSA-2013-0640.html WEB
http://rhn.redhat.com/errata/RHSA-2013-0647.html WEB
http://rhn.redhat.com/errata/RHSA-2013-0648.html WEB
http://rhn.redhat.com/errata/RHSA-2013-0726.html WEB
http://svn.apache.org/viewvc?view=revision&revision=1377807 WEB
http://svn.apache.org/viewvc?view=revision&revision=1380829 WEB
http://svn.apache.org/viewvc?view=revision&revision=1392248 WEB
http://tomcat.apache.org/security-5.html WEB
http://tomcat.apache.org/security-6.html WEB
http://tomcat.apache.org/security-7.html WEB
http://www-01.ibm.com/support/docview.wss?uid=swg21626891 WEB
http://www.ubuntu.com/usn/USN-1637-1 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database