tomcat: information disclosure in authentication headers
Published Apr 23, 2010
2.6
LOWCVSS 2.0
EPSS 52.51%
Description
Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
Affected products
No data.
Configuration 1
- 5.5.0
- 5.5.1
- 5.5.2
- 5.5.3
- 5.5.4
- 5.5.5
- 5.5.6
- 5.5.7
- 5.5.8
- 5.5.9
- 5.5.10
- 5.5.11
- 5.5.12
- 5.5.13
- 5.5.14
- 5.5.15
- 5.5.16
- 5.5.17
- 5.5.18
- 5.5.19
- 5.5.20
- 5.5.21
- 5.5.22
- 5.5.23
- 5.5.24
- 5.5.25
- 5.5.26
- 5.5.27
- 5.5.28
- 5.5.29
Configuration 2
- 6.0.0
- 6.0.1
- 6.0.2
- 6.0.3
- 6.0.4
- 6.0.5
- 6.0.6
- 6.0.7
- 6.0.8
- 6.0.9
- 6.0.10
- 6.0.11
- 6.0.12
- 6.0.13
- 6.0.14
- 6.0.15
- 6.0.16
- 6.0.17
- 6.0.18
- 6.0.19
- 6.0.20
- 6.0.24
- 6.0.26
No data.
JBEAP 4.2.0 for RHEL 5
jbossweb-0:2.0.0-6.CP14.0jpp.ep1.1.el5
Fixed · RHSA-2010:0584
Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5
jbossweb-0:2.0.0-6.CP14.0jpp.ep1.1.el5
Fixed · RHSA-2010:0584
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
ant-0:1.7.1-13.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
antlr-0:2.7.7-7.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
cglib-0:2.2-5.1.1.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
dom4j-0:1.6.1-11.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
ecj3-1:3.3.1.1-3.1.1.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
glassfish-jsf-0:1.2_13-3.1.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
hibernate3-1:3.3.2-1.4.GA_CP04.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
hibernate3-annotations-0:3.4.0-3.2.GA_CP04.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
httpd-0:2.2.17-11.1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-beanutils-0:1.8.0-4.1.2.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-chain-0:1.2-2.2.1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-codec-0:1.3-9.2.1.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-collections-0:3.2.1-4.1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-daemon-1:1.0.5-1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-httpclient-1:3.1-1.2.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-oro-0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jakarta-taglibs-standard-0:1.1.1-9.1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
javassist-0:3.12.0-1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jboss-common-core-0:2.2.17-1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jboss-common-logging-jdk-0:2.1.2-1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jboss-common-logging-spi-0:2.1.2-1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jboss-javaee-0:5.0.1-2.9.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jcommon-0:1.0.16-1.2.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
mod_cluster-0:1.0.10-2.1.GA_CP01.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
mod_cluster-native-0:1.0.10-2.1.GA_CP01.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
mod_jk-0:1.2.31-1.1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
struts12-0:1.2.9-3.1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
tomcat-jkstatus-ant-0:1.2.31-2.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
tomcat-native-0:1.1.20-2.1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
tomcat5-0:5.5.33-16_patch_04.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
tomcat6-0:6.0.32-15.1_patch_03.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
xalan-j2-0:2.7.1-5.3_patch_04.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
xerces-j2-0:2.9.1-3.patch01.1.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5
xml-commons-0:1.3.04-7.10.jdk6.ep5.el5
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
ant-0:1.7.1-14.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
antlr-0:2.7.7-7.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
cglib-0:2.2-5.4.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
dom4j-0:1.6.1-11.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
ecj3-1:3.3.1.1-4.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
glassfish-jsf-0:1.2_13-3.1.4.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
hibernate3-1:3.3.2-1.8.GA_CP04.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
hibernate3-annotations-0:3.4.0-3.5.GA_CP04.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.3.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
hibernate3-entitymanager-0:3.4.0-4.4.GA_CP04.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
httpd-0:2.2.17-11.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-beanutils-0:1.8.0-9.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-chain-0:1.2-2.2.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-codec-0:1.3-12.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-collections-0:3.2.1-4.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-daemon-1:1.0.5-1.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-dbcp-0:1.2.1-16.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-digester-0:1.8.1-8.1.1.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-fileupload-1:1.1.1-7.5.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-httpclient-1:3.1-1.2.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-io-0:1.4-4.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-logging-0:1.1.1-1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-logging-jboss-0:1.1-10.2.2.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-pool-0:1.3-15.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-oro-0:2.0.8-7.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jakarta-taglibs-standard-0:1.1.1-12.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
javassist-0:3.12.0-3.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jboss-common-core-0:2.2.17-1.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jboss-common-logging-jdk-0:2.1.2-1.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jboss-common-logging-spi-0:2.1.2-1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jboss-javaee-0:5.0.1-2.9.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jcommon-0:1.0.16-1.2.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
jfreechart-0:1.0.13-2.3.2.1.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
mod_cluster-0:1.0.10-2.2.GA_CP01.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
mod_cluster-native-0:1.0.10-2.1.1.GA_CP01.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
mod_jk-0:1.2.31-1.1.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
objectweb-asm31-0:3.1-12.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
struts12-0:1.2.9-3.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
tomcat-jkstatus-ant-0:1.2.31-2.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
tomcat-native-0:1.1.20-2.1.2.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
tomcat5-0:5.5.33-15_patch_04.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
tomcat6-0:6.0.32-14_patch_03.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
xalan-j2-0:2.7.1-5.3_patch_04.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
xerces-j2-0:2.9.1-8.patch01.1.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6
xml-commons-0:1.3.04-7.14.ep5.el6
Fixed · RHSA-2011:0897
Red Hat JBoss Web Server 1.0
n/a
Fixed · RHSA-2011:0896
Red Hat Enterprise Linux 5
tomcat5
Will not fix
Red Hat Enterprise Linux 6
tomcat6
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| JBEAP 4.2.0 for RHEL 5 | jbossweb-0:2.0.0-6.CP14.0jpp.ep1.1.el5 | Fixed | RHSA-2010:0584 |
| Red Hat JBoss Enterprise Application Platform 4.3 for RHEL 5 | jbossweb-0:2.0.0-6.CP14.0jpp.ep1.1.el5 | Fixed | RHSA-2010:0584 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | ant-0:1.7.1-13.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | antlr-0:2.7.7-7.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | cglib-0:2.2-5.1.1.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | dom4j-0:1.6.1-11.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | ecj3-1:3.3.1.1-3.1.1.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | glassfish-jsf-0:1.2_13-3.1.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | hibernate3-1:3.3.2-1.4.GA_CP04.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | hibernate3-annotations-0:3.4.0-3.2.GA_CP04.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | httpd-0:2.2.17-11.1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-beanutils-0:1.8.0-4.1.2.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-chain-0:1.2-2.2.1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-codec-0:1.3-9.2.1.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-collections-0:3.2.1-4.1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-daemon-1:1.0.5-1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-httpclient-1:3.1-1.2.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-oro-0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jakarta-taglibs-standard-0:1.1.1-9.1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | javassist-0:3.12.0-1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jboss-common-core-0:2.2.17-1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jboss-common-logging-jdk-0:2.1.2-1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jboss-common-logging-spi-0:2.1.2-1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jboss-javaee-0:5.0.1-2.9.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jcommon-0:1.0.16-1.2.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | mod_cluster-0:1.0.10-2.1.GA_CP01.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | mod_cluster-native-0:1.0.10-2.1.GA_CP01.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | mod_jk-0:1.2.31-1.1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | struts12-0:1.2.9-3.1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | tomcat-jkstatus-ant-0:1.2.31-2.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | tomcat-native-0:1.1.20-2.1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | tomcat5-0:5.5.33-16_patch_04.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | tomcat6-0:6.0.32-15.1_patch_03.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | xalan-j2-0:2.7.1-5.3_patch_04.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | xerces-j2-0:2.9.1-3.patch01.1.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | xml-commons-0:1.3.04-7.10.jdk6.ep5.el5 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | ant-0:1.7.1-14.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | antlr-0:2.7.7-7.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | cglib-0:2.2-5.4.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | dom4j-0:1.6.1-11.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | ecj3-1:3.3.1.1-4.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | glassfish-jsf-0:1.2_13-3.1.4.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | hibernate3-1:3.3.2-1.8.GA_CP04.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | hibernate3-annotations-0:3.4.0-3.5.GA_CP04.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.3.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | hibernate3-entitymanager-0:3.4.0-4.4.GA_CP04.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | httpd-0:2.2.17-11.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-beanutils-0:1.8.0-9.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-chain-0:1.2-2.2.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-codec-0:1.3-12.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-collections-0:3.2.1-4.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-daemon-1:1.0.5-1.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-dbcp-0:1.2.1-16.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-digester-0:1.8.1-8.1.1.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-fileupload-1:1.1.1-7.5.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-httpclient-1:3.1-1.2.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-io-0:1.4-4.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-logging-0:1.1.1-1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-logging-jboss-0:1.1-10.2.2.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-pool-0:1.3-15.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-oro-0:2.0.8-7.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jakarta-taglibs-standard-0:1.1.1-12.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | javassist-0:3.12.0-3.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jboss-common-core-0:2.2.17-1.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jboss-common-logging-jdk-0:2.1.2-1.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jboss-common-logging-spi-0:2.1.2-1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jboss-javaee-0:5.0.1-2.9.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jcommon-0:1.0.16-1.2.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | jfreechart-0:1.0.13-2.3.2.1.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | mod_cluster-0:1.0.10-2.2.GA_CP01.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | mod_cluster-native-0:1.0.10-2.1.1.GA_CP01.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | mod_jk-0:1.2.31-1.1.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | objectweb-asm31-0:3.1-12.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | struts12-0:1.2.9-3.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | tomcat-jkstatus-ant-0:1.2.31-2.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | tomcat-native-0:1.1.20-2.1.2.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | tomcat5-0:5.5.33-15_patch_04.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | tomcat6-0:6.0.32-14_patch_03.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | xalan-j2-0:2.7.1-5.3_patch_04.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | xerces-j2-0:2.9.1-8.patch01.1.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | xml-commons-0:1.3.04-7.14.ep5.el6 | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1.0 | n/a | Fixed | RHSA-2011:0896 |
| Red Hat Enterprise Linux 5 | tomcat5 | Will not fix | n/a |
| Red Hat Enterprise Linux 6 | tomcat6 | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
The risks associated with fixing this flaw are greater than the low severity security risk. We therefore have no plans to fix this flaw. The information leak can be avoided by adjusting the configuration to always specify a realm-name.
References (54)
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html vendor-advisoryx_refsource_APPLE
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html vendor-advisoryx_refsource_SUSE
- http://marc.info/?l=bugtraq&m=129070310906557&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=133469267822771&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=136485229118404&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=139344343412337&w=2 vendor-advisoryx_refsource_HP
- http://secunia.com/advisories/39574 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/42368 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/43310 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/57126 third-party-advisoryx_refsource_SECUNIA
- http://support.apple.com/kb/HT5002 x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=936540 x_refsource_CONFIRMPatch
- http://svn.apache.org/viewvc?view=revision&revision=936541 x_refsource_CONFIRMPatch
- http://tomcat.apache.org/security-5.html x_refsource_CONFIRMPatchVendor Advisory
- http://tomcat.apache.org/security-6.html x_refsource_CONFIRMPatchVendor Advisory
- http://www.debian.org/security/2011/dsa-2207 vendor-advisoryx_refsource_DEBIAN
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:176 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:177 vendor-advisoryx_refsource_MANDRIVA
- http://www.redhat.com/support/errata/RHSA-2011-0896.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2011-0897.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/510879/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/516397/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/39635 vdb-entryx_refsource_BID
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html x_refsource_CONFIRM
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html x_refsource_CONFIRM
- http://www.vupen.com/english/advisories/2010/0980 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2010/3056 vdb-entryx_refsource_VUPENVendor Advisory
- https://access.redhat.com/security/cve/CVE-2010-1157 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=585331 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5514 Advisory
- https://github.com/advisories/GHSA-w6q7-ww2x-7gm3 Advisory
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
- https://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
- https://marc.info/?l=bugtraq&m=129070310906557&w=2
- https://marc.info/?l=bugtraq&m=133469267822771&w=2
- https://marc.info/?l=bugtraq&m=136485229118404&w=2
- https://marc.info/?l=bugtraq&m=139344343412337&w=2
- https://nvd.nist.gov/vuln/detail/CVE-2010-1157
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19492 vdb-entrysignaturex_refsource_OVAL
- https://support.apple.com/kb/HT5002
- https://svn.apache.org/viewvc?view=revision&revision=936540
- https://svn.apache.org/viewvc?view=revision&revision=936541
- https://tomcat.apache.org/security-5.html
- https://tomcat.apache.org/security-6.html
- https://www.cve.org/CVERecord?id=CVE-2010-1157
- https://www.debian.org/security/2011/dsa-2207
Change history (0)
No recorded changes yet.