GHSA-hffm-fqv4-w27r
Improper Authentication in Apache Tomcat
At a glance
- Published
- Updated
- CVE
- CVE-2011-5063
Description
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 5.5.0, fixed 5.5.34 |
| Maven · org.apache.tomcat:tomcat | introduced 6.0.0, fixed 6.0.33 |
| Maven · org.apache.tomcat:tomcat | introduced 7.0.0, fixed 7.0.12 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-5063 ADVISORY
- https://github.com/apache/tomcat/commit/639e20992a66d7a42fb59c974db91c8a0f730a1e WEB
- https://github.com/apache/tomcat55/commit/644dfdf96cf82fcd2a2046d93f2b5495f7e94584 WEB
- https://access.redhat.com/errata/RHSA-2012:0074 WEB
- https://access.redhat.com/errata/RHSA-2012:0075 WEB
- https://access.redhat.com/errata/RHSA-2012:0076 WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E WEB
- https://web.archive.org/web/20151017023138/http://secunia.com/advisories/57126 WEB
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00002.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00006.html WEB
- http://marc.info/?l=bugtraq&m=139344343412337&w=2 WEB
- http://svn.apache.org/viewvc?view=rev&rev=1087655 WEB
- http://svn.apache.org/viewvc?view=rev&rev=1158180 WEB
- http://svn.apache.org/viewvc?view=rev&rev=1159309 WEB
- http://tomcat.apache.org/security-5.html WEB
- http://tomcat.apache.org/security-6.html WEB
- http://tomcat.apache.org/security-7.html WEB
- http://www.debian.org/security/2012/dsa-2401 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |