Bugzilla – Bug 791426
VUL-0: CVE-2012-5887: tomcat: stale nonce weakness
Last modified: 2019-05-01 15:50:15 UTC
Name: CVE-2012-5887 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. Reference: CONFIRM: http://tomcat.apache.org/security-7.html Reference: CONFIRM: http://tomcat.apache.org/security-6.html Reference: CONFIRM: http://tomcat.apache.org/security-5.html Reference: CONFIRM: http://svn.apache.org/viewvc?view=revision&revision=1392248 Reference: CONFIRM: http://svn.apache.org/viewvc?view=revision&revision=1380829 Reference: CONFIRM: http://svn.apache.org/viewvc?view=revision&revision=1377807
(In reply to comment #0) > Name: CVE-2012-5887 Well, tomcat security and commit logs use the CVE-2012-3439. Reading the Nist page, this should not be used. Can you close the bnc#CVE-2012-3439, then? I will resubmit the package(s) with a correct CVE number then. [1] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3439
I meant bnc#789405
*** Bug 789405 has been marked as a duplicate of this bug. ***
The SWAMPID for this issue is 50301. This issue was rated as moderate. Please submit fixed packages until 2012-12-12. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
I have seen tomcat submits, buts its probably not all issues included, as some just arrived yesterday. Do we need resubmits (SWAMP 50301)
All patches are ready, but the bnc#791679 looking for the input of security-team needs to be resolved first.
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/144019 Maintenance /
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/144552 Maintenance /
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/144937 Maintenance /
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/144949 Maintenance /
submitted fixed packages tomcat(7): 12.2 144949 factory contains 7.0.33 with no security issues inside tomcat6: 12.1 144937 sle11 23071 tomcat5: sle10 23077
upps, again tomcat6 12.1 144953
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/144953 Maintenance /
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/144989 Maintenance / https://build.opensuse.org/request/show/144990 Maintenance /
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/145902 Maintenance /
openSUSE-SU-2012:1700-1: An update that fixes 10 vulnerabilities is now available. Category: security (moderate) Bug References: 789406,791423,791424,791426,791679,793391,793394 CVE References: CVE-2009-2693,CVE-2009-2901,CVE-2009-2902,CVE-2012-2733,CVE-2012-3546,CVE-2012-4431,CVE-2012-5568,CVE-2012-5885,CVE-2012-5886,CVE-2012-5887 Sources used: openSUSE 12.1 (src): libtcnative-1-0-1.3.3-3.7.1, tomcat6-6.0.33-3.7.1
openSUSE-SU-2012:1701-1: An update that fixes 10 vulnerabilities is now available. Category: security (moderate) Bug References: 779538,789406,791423,791424,791426,791679,793391,793394 CVE References: CVE-2009-2693,CVE-2009-2901,CVE-2009-2902,CVE-2012-2733,CVE-2012-3546,CVE-2012-4431,CVE-2012-5568,CVE-2012-5885,CVE-2012-5886,CVE-2012-5887 Sources used: openSUSE 12.2 (src): tomcat-7.0.27-2.9.1
Update released for: tomcat5, tomcat5-admin-webapps, tomcat5-webapps Products: SLE-SERVER 10-SP3-TERADATA (x86_64)
Update released for: tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp, tomcat6-javadoc, tomcat6-jsp-2_1-api, tomcat6-lib, tomcat6-servlet-2_5-api, tomcat6-webapps Products: SLE-SERVER 11-SP1-TERADATA (x86_64) SUSE-MANAGER 1.2 (x86_64)
Update released for: tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp, tomcat6-javadoc, tomcat6-jsp-2_1-api, tomcat6-lib, tomcat6-servlet-2_5-api, tomcat6-webapps Products: SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64)
Update released for: tomcat5, tomcat5-admin-webapps, tomcat5-webapps Products: SLE-SDK 10-SP4 (i386, ia64, ppc, s390x, x86_64) SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
released
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/196597 Evergreen:11.2 / tomcat6
This is an autogenerated message for OBS integration: This bug (791426) was mentioned in https://build.opensuse.org/request/show/198409 Evergreen:11.2 / tomcat6