CVE-2007-1858
NoneCVSS
—
EPSS
18.3%
Published
May 10, 2007
CISA due date
—
The record
The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:network_satellite:4.0::el3 | jakarta-commons-pool | 0 | 0:1.2-2jpp_2rh |
| Red Hat:network_satellite:4.0::el3 | tomcat5 | 0 | 0:5.0.30-0jpp_6rh |
| Red Hat:network_satellite:4.0::el3 | tyrex | 0 | 0:1.0.1-2jpp_2rh |
| Red Hat:network_satellite:4.0::el4 | jakarta-commons-pool | 0 | 0:1.2-2jpp_2rh |
| Red Hat:network_satellite:4.0::el4 | tomcat5 | 0 | 0:5.0.30-0jpp_6rh |
| Red Hat:network_satellite:4.0::el4 | tyrex | 0 | 0:1.0.1-2jpp_2rh |
| Red Hat:network_satellite:4.1::el3 | jakarta-commons-pool | 0 | 0:1.2-2jpp_2rh |
| Red Hat:network_satellite:4.1::el3 | tomcat5 | 0 | 0:5.0.30-0jpp_6rh |
| Red Hat:network_satellite:4.1::el3 | tyrex | 0 | 0:1.0.1-2jpp_2rh |
| Red Hat:network_satellite:4.1::el4 | jakarta-commons-pool | 0 | 0:1.2-2jpp_2rh |
| Red Hat:network_satellite:4.1::el4 | tomcat5 | 0 | 0:5.0.30-0jpp_6rh |
| Red Hat:network_satellite:4.1::el4 | tyrex | 0 | 0:1.0.1-2jpp_2rh |
| Red Hat:network_satellite:4.2::el3 | jakarta-commons-pool | 0 | 0:1.2-2jpp_2rh |
| Red Hat:network_satellite:4.2::el3 | tomcat5 | 0 | 0:5.0.30-0jpp_6rh |
| Red Hat:network_satellite:4.2::el3 | tyrex | 0 | 0:1.0.1-2jpp_2rh |
| Red Hat:network_satellite:4.2::el4 | jakarta-commons-pool | 0 | 0:1.2-2jpp_2rh |
| Red Hat:network_satellite:4.2::el4 | tomcat5 | 0 | 0:5.0.30-0jpp_6rh |
| Red Hat:network_satellite:4.2::el4 | tyrex | 0 | 0:1.0.1-2jpp_2rh |
| Red Hat:network_satellite:5.0:el4 | jakarta-commons-pool | 0 | 0:1.2-2jpp_2rh |
| Red Hat:network_satellite:5.0:el4 | tomcat5 | 0 | 0:5.0.30-0jpp_6rh |
| Red Hat:network_satellite:5.0:el4 | tyrex | 0 | 0:1.0.1-2jpp_2rh |
| Red Hat:rhel_application_server:1 | tomcat5 | 0 | 0:5.0.30-0jpp_5rh |
| Red Hat:rhel_application_server:1 | tomcat5-admin-webapps | 0 | 0:5.0.30-0jpp_5rh |
| Red Hat:rhel_application_server:1 | tomcat5-webapps | 0 | 0:5.0.30-0jpp_5rh |
| Red Hat:rhel_application_server:2 | jakarta-commons-modeler | 0 | 0:2.0-3jpp_2rh |
| Red Hat:rhel_application_server:2 | jakarta-commons-modeler-javadoc | 0 | 0:2.0-3jpp_2rh |
| Red Hat:rhel_application_server:2 | tomcat5 | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-common-lib | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-jasper | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-server-lib | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp_4rh.3 |
| Red Hat:rhel_application_server:2 | tomcat5-webapps | 0 | 0:5.5.23-0jpp_4rh.3 |
Related vulnerabilities
- CVE-2007-3385 Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3… Also affects jakarta-commons-pool
- CVE-2007-3382 Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3… Also affects jakarta-commons-pool
- CVE-2007-0450 Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and… Also affects jakarta-commons-pool
- CVE-2006-3835 Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon… Also affects jakarta-commons-pool
- CVE-2005-2090 Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers… Also affects jakarta-commons-pool
- CVE-2008-0128 The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat… Also affects tomcat5
- CVE-2007-6388 Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0… Also affects tomcat5
- CVE-2007-5000 Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP… Also affects tomcat5