The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not

Summary

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.

Timeline

1. Jan 14, 2012, 9:00 PM UTCCVE published
2. Aug 7, 2024, 12:23 AM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• org.apache.tomcat:tomcatMaven

  From 5.5.0 · fixed in 5.5.34

• org.apache.tomcat:tomcatMaven

  From 6.0.0 · fixed in 6.0.33

• org.apache.tomcat:tomcatMaven

  From 7.0.0 · fixed in 7.0.12

References 22