CVE-2012-5887

Name	CVE-2012-5887
Description	The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	692439, 692440

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tomcat6 (PTS)	jessie, jessie (lts)	6.0.45+dfsg-1~deb8u1	fixed
tomcat7 (PTS)	jessie, jessie (lts)	7.0.56-3+really7.0.109-1+deb8u6	fixed
	stretch	7.0.75-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
tomcat6	source	squeeze	6.0.35-1+squeeze3
tomcat6	source	(unstable)	6.0.35-5+nmu1	692439
tomcat7	source	(unstable)	7.0.28-3+nmu1	692440

DSA 2725