Red Hat Customer Portal

Skip to main content

CVE-2012-5887

Impact:
Moderate
Public Date:
2012-11-05
Bugzilla:
873664: CVE-2012-5885 CVE-2012-5886 CVE-2012-5887 tomcat: three DIGEST authentication implementation issues

The MITRE CVE dictionary describes this issue as:

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

Find out more about CVE-2012-5887 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 5
Base Metrics AV:N/AC:L/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server (jbossweb) RHSA-2013:0629 2013-03-11
Red Hat Enterprise Linux 6 (tomcat6) RHSA-2013:0623 2013-03-11
Red Hat JBoss Web Platform 5 for RHEL 6 Server (jbossweb) RHSA-2013:0631 2013-03-11
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server (jbossweb) RHSA-2013:0647 2013-03-14
Red Hat Enterprise Linux 5 (tomcat5) RHSA-2013:0640 2013-03-12
Red Hat JBoss SOA Platform 5.3 RHSA-2013:0726 2013-04-09
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server (jbossweb) RHSA-2013:0647 2013-03-14
Red Hat JBoss Web Platform 5.2 RHSA-2013:0633 2013-03-11
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server (tomcat6) RHSA-2013:0266 2013-02-19
Red Hat JBoss Web Platform 5 for RHEL 4 AS (jbossweb) RHSA-2013:0631 2013-03-11
JBoss Data Grid 6.1 RHSA-2013:0665 2013-03-20
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS (jbossweb) RHSA-2013:0629 2013-03-11
JBoss Enterprise BRMS Platform 5.3 RHSA-2013:1006 2013-07-01
Red Hat JBoss Web Platform 5 for RHEL 5 Server (jbossweb) RHSA-2013:0631 2013-03-11
Red Hat JBoss Web Server 2.0 RHSA-2013:0265 2013-02-19
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server (jbossweb) RHSA-2013:0629 2013-03-11
Red Hat JBoss Enterprise Application Platform 5.2 RHSA-2013:0632 2013-03-11
Red Hat JBoss Enterprise Application Platform 6.0 RHSA-2013:0648 2013-03-14
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server (tomcat6) RHSA-2013:0266 2013-02-19

Affected Packages State

Platform Package State
Red Hat JBoss Portal 5 jbossweb Will not fix
Red Hat Jboss BRMS 5 jbossweb Affected
Red Hat JBoss Operations Network 3.1 jbossweb Not affected

Last Modified