Important CentOS tomcat5 Update

Metadata

medium
5.0
tomcat5-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-5.5.23-0jpp.38.el5_9.src.rpm, tomcat5-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-admin-webapps-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-admin-webapps-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-common-lib-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-common-lib-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-jasper-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-jasper-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-jasper-javadoc-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-jasper-javadoc-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-jsp-2.0-api-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-jsp-2.0-api-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-server-lib-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-server-lib-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-servlet-2.4-api-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-servlet-2.4-api-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.38.el5_9.x86_64.rpm, tomcat5-webapps-5.5.23-0jpp.38.el5_9.i386.rpm, tomcat5-webapps-5.5.23-0jpp.38.el5_9.x86_64.rpm
CVE-2012-3546, CVE-2012-5885, CVE-2012-5886, CVE-2012-5887
rhn.redhat.com, lists.centos.org
2013-03-12
2017-07-27 19:05
Important CentOS tomcat6 Update
CVE-2012-3546 tomcat7
CVE-2012-5885 tomcat7
CVE-2012-5886 tomcat6
CVE-2012-5887 tomcat6
CVE-2012-5886 tomcat7
CVE-2012-3546 tomcat6
CVE-2012-5887 tomcat7
CVE-2012-5885 tomcat6
CVE-2012-5885
CVE-2012-5887
CVE-2012-3546
CVE-2012-5886
2017-04-01 19:06
2017-01-05 20:10

Description


Updated tomcat5 packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container.

It was found that when an application used FORM authentication, along with
another component that calls request.setUserPrincipal() before the call to
FormAuthenticator#authenticate() (such as the Single-Sign-On valve), it was
possible to bypass the security constraint checks in the FORM authenticator
by appending "/j_security_check" to the end of a URL. A remote attacker
with an authenticated session on an affected application could use this
flaw to circumvent authorization controls, and thereby access resources not
permitted by the roles associated with their authenticated session.
(CVE-2012-3546)

Multiple weaknesses were found in the Tomcat DIGEST authentication
implementation, effectively reducing the security normally provided by
DIGEST authentication. A remote attacker could use these flaws to perform
replay attacks in some circumstances. (CVE-2012-5885, CVE-2012-5886,
CVE-2012-5887)

Users of Tomcat should upgrade to these updated packages, which correct
these issues. Tomcat must be restarted for this update to take effect.
Please see https://www.redhat.com/footer/terms-of-use.html

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Release Package Patched in
5 tomcat5 tomcat5-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5 tomcat5-5.5.23-0jpp.38.el5_9.src.rpm
tomcat5 tomcat5-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-admin-webapps tomcat5-admin-webapps-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-admin-webapps tomcat5-admin-webapps-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-common-lib tomcat5-common-lib-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-common-lib tomcat5-common-lib-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-jasper tomcat5-jasper-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-jasper tomcat5-jasper-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-jasper-javadoc tomcat5-jasper-javadoc-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-jasper-javadoc tomcat5-jasper-javadoc-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-jsp-2.0-api tomcat5-jsp-2.0-api-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-jsp-2.0-api tomcat5-jsp-2.0-api-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-jsp-2.0-api-javadoc tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-jsp-2.0-api-javadoc tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-server-lib tomcat5-server-lib-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-server-lib tomcat5-server-lib-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-servlet-2.4-api tomcat5-servlet-2.4-api-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-servlet-2.4-api tomcat5-servlet-2.4-api-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-servlet-2.4-api-javadoc tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-servlet-2.4-api-javadoc tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.38.el5_9.x86_64.rpm
tomcat5-webapps tomcat5-webapps-5.5.23-0jpp.38.el5_9.i386.rpm
tomcat5-webapps tomcat5-webapps-5.5.23-0jpp.38.el5_9.x86_64.rpm