VDB
RHSA-2013%3A0632
RHSA-2013%3A0632
PUBLISHED
CVSS 5 MEDIUM
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
Risk Scores
CVSS 2.0
5
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform 5.2 |
Timeline
- Mar 11, 2013 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Jun 27, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2013:0632 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=5.2.0 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=873664 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0632.json advisory
- https://access.redhat.com/security/cve/CVE-2012-5885 advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5885 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5885 advisory
- https://access.redhat.com/security/cve/CVE-2012-5886 advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5886 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5886 advisory
- https://access.redhat.com/security/cve/CVE-2012-5887 advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5887 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5887 advisory