CVE-2012-5886

Name	CVE-2012-5886
Description	The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	692439, 692440

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tomcat6 (PTS)	jessie, jessie (lts)	6.0.45+dfsg-1~deb8u1	fixed
tomcat7 (PTS)	jessie, jessie (lts)	7.0.56-3+really7.0.109-1+deb8u6	fixed
	stretch	7.0.75-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
tomcat6	source	squeeze	6.0.35-1+squeeze3
tomcat6	source	(unstable)	6.0.35-5+nmu1	692439
tomcat7	source	(unstable)	7.0.28-3+nmu1	692440

DSA 2725