VDB
RHSA-2013:0633
RHSA-2013:0633
PUBLISHED
CVSS 5 MEDIUM
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
Risk Scores
CVSS 2.0
5
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Web Platform 5.2 |
Timeline
- Mar 11, 2013 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Jun 27, 2026 CVE Updated
- Jun 27, 2026 Distribution Patch
- Jun 27, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2013:0633 advisory
- https://access.redhat.com/security/cve/CVE-2012-5885 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5885 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5886 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=enterpriseweb.platform&downloadType=securityPatches&version=5.2.0 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=873664 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0633.json advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5885 advisory
- https://access.redhat.com/security/cve/CVE-2012-5886 advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5886 advisory
- https://access.redhat.com/security/cve/CVE-2012-5887 advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5887 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5887 advisory