{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Rational AppScan Enterprise / Security AppScan Enterprise versions 8.0 \u00e0 8.6 incluses ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Rational Policy Tester versions 8.0 \u00e0 8.5.0.1 incluses.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-5062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-5062"
    },
    {
      "name": "CVE-2011-2729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2729"
    },
    {
      "name": "CVE-2011-3190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3190"
    },
    {
      "name": "CVE-2011-0013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-0013"
    },
    {
      "name": "CVE-2011-5063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-5063"
    },
    {
      "name": "CVE-2011-1184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1184"
    },
    {
      "name": "CVE-2011-2526",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2526"
    },
    {
      "name": "CVE-2011-5064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-5064"
    },
    {
      "name": "CVE-2011-2204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2204"
    }
  ],
  "links": [],
  "reference": "CERTA-2012-AVI-474",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-08-31T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eIBM\u003c/span\u003e. Parmi celles-ci, une vuln\u00e9rabilit\u00e9 permet \u00e0\nun attaquant d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance au moyen d\u0027un\nfichier de param\u00e8trage sp\u00e9cialement con\u00e7u.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM AppScan Enterprise and Policy Tester",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21609004 du 27 ao\u00fbt 2012",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21609004"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eHP XP P9000 Performance Advisor Software versions 5.4.1 et  ant\u00e9rieures\u003c/P\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-5062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-5062"
    },
    {
      "name": "CVE-2011-2729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2729"
    },
    {
      "name": "CVE-2010-4172",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-4172"
    },
    {
      "name": "CVE-2011-3190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-3190"
    },
    {
      "name": "CVE-2011-0534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-0534"
    },
    {
      "name": "CVE-2008-0002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0002"
    },
    {
      "name": "CVE-2009-2901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2901"
    },
    {
      "name": "CVE-2011-0013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-0013"
    },
    {
      "name": "CVE-2013-0366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0366"
    },
    {
      "name": "CVE-2013-0381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0381"
    },
    {
      "name": "CVE-2009-2693",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2693"
    },
    {
      "name": "CVE-2011-5063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-5063"
    },
    {
      "name": "CVE-2009-2902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2902"
    },
    {
      "name": "CVE-2012-4431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4431"
    },
    {
      "name": "CVE-2013-0354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0354"
    },
    {
      "name": "CVE-2007-5461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5461"
    },
    {
      "name": "CVE-2010-2227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2227"
    },
    {
      "name": "CVE-2008-1232",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-1232"
    },
    {
      "name": "CVE-2011-1184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1184"
    },
    {
      "name": "CVE-2013-0372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0372"
    },
    {
      "name": "CVE-2011-2526",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2526"
    },
    {
      "name": "CVE-2013-0363",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0363"
    },
    {
      "name": "CVE-2009-3548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3548"
    },
    {
      "name": "CVE-2008-2370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-2370"
    },
    {
      "name": "CVE-2013-0364",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0364"
    },
    {
      "name": "CVE-2012-3546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3546"
    },
    {
      "name": "CVE-2007-5333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5333"
    },
    {
      "name": "CVE-2012-3219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3219"
    },
    {
      "name": "CVE-2008-1947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-1947"
    },
    {
      "name": "CVE-2012-4534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4534"
    },
    {
      "name": "CVE-2013-0352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0352"
    },
    {
      "name": "CVE-2013-0397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0397"
    },
    {
      "name": "CVE-2007-6286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6286"
    },
    {
      "name": "CVE-2013-0361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0361"
    },
    {
      "name": "CVE-2011-5064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-5064"
    },
    {
      "name": "CVE-2010-3718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-3718"
    },
    {
      "name": "CVE-2007-5342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5342"
    },
    {
      "name": "CVE-2012-3190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3190"
    },
    {
      "name": "CVE-2011-2481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2481"
    },
    {
      "name": "CVE-2011-5035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-5035"
    },
    {
      "name": "CVE-2011-2204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2204"
    },
    {
      "name": "CVE-2010-1157",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1157"
    },
    {
      "name": "CVE-2012-2733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2733"
    }
  ],
  "links": [],
  "reference": "CERTFR-2014-AVI-089",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2014-02-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eHP XP P9000 Performance Advisor Software\u003c/span\u003e.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un d\u00e9ni de service et un contournement de\nla politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans HP XP P9000 Performance Advisor Software",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 HP c04047415 du 25 f\u00e9vrier 2014",
      "url": "http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c04047415-1"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB203AEC-2A94-48CA-A0E0-B5A8EBF028B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E98B82A-22E5-4E6C-90AE-56F5780EA147",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "34672E90-C220-436B-9143-480941227933",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "92883AFA-A02F-41A5-9977-ABEAC8AD2970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "989A78F8-EE92-465F-8A8D-ECF0B58AFE7A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F5B6627-B4A4-4E2D-B96C-CA37CCC8C804",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACFB09F3-32D1-479C-8C39-D7329D9A6623",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "D56581E2-9ECD-426A-96D8-A9D958900AD2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "717F6995-5AF0-484C-90C0-A82F25FD2E32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B0C01D5-773F-469C-9E69-170C2844AAA4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB03FDFB-4DBF-4B70-BFA3-570D1DE67695",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F5CF79C-759B-4FF9-90EE-847264059E93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "357651FD-392E-4775-BF20-37A23B3ABAE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "585B9476-6B86-4809-9B9E-26112114CB59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "6145036D-4FCE-4EBE-A137-BDFA69BA54F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "E437055A-0A81-413F-AB08-0E9D0DC9EA30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "9276A093-9C98-4617-9941-2276995F5848",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "97C9C36C-EF7E-4D42-9749-E2FF6CE35A2E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "C98575E2-E39A-4A8F-B5B5-BD280B8367BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BDA08E7-A417-44E8-9C89-EB22BEEC3B9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCD1B6BE-CF07-4DA8-A703-4A48506C8AD6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "5878E08E-2741-4798-94E9-BA8E07386B12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "69F6BAB7-C099-4345-A632-7287AEA555B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3AAF031-D16B-4D51-9581-2D1376A5157B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "51120689-F5C0-4DF1-91AA-314C40A46C58",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "F67477AB-85F6-421C-9C0B-C8EFB1B200CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "16D0C265-2ED9-42CF-A7D6-C7FAE4246A1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D70CFD9-B55D-4A29-B94C-D33F3E881A8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1195878-CCC9-49BC-9AC7-1F88F0DFAB82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:*",
              "matchCriteriaId": "375C26A9-623E-483A-BC11-468D9DE278C1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCDDD480-3C9E-4BE9-848A-99A13145C2AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "42BB8770-0BB4-4F23-AE24-58745095060D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B980C39-A4D8-483A-B48C-36CA4F5CEAA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:5.5.33:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFF7178D-DC9B-45F7-BEA4-701B1EAEC2CC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D11D6FB7-CBDB-48C1-98CB-1B3CAA36C5D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "49E3C039-A949-4F1B-892A-57147EECB249",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F28C7801-41B9-4552-BA1E-577967BCBBEE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "25B21085-7259-4685-9D1F-FF98E6489E10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "635EE321-2A1F-4FF8-95BE-0C26591969D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A81B035-8598-4D2C-B45F-C6C9D4B10C2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1096947-82A6-4EA8-A4F2-00D91E3F7DAF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EBFA1D3-16A6-4041-BB30-51D2EE0F2AF4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "B70B372F-EFFD-4AF7-99B5-7D1B23A0C54C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C95ADA4-66F5-45C4-A677-ACE22367A75A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "11951A10-39A2-4FF5-8C43-DF94730FB794",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "351E5BCF-A56B-4D91-BA3C-21A4B77D529A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DC2BBB4-171E-4EFF-A575-A5B7FF031755",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B6B0504-27C1-4824-A928-A878CBBAB32D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE81AD36-ACD1-4C6C-8E7C-5326D1DA3045",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "D903956B-14F5-4177-AF12-0A5F1846D3C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "81F847DC-A2F5-456C-9038-16A0E85F4C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF3EBD00-1E1E-452D-AFFB-08A6BD111DDD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6B93A3A-D487-4CA1-8257-26F8FE287B8B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD8802B2-57E0-4AA6-BC8E-00DE60468569",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "8461DF95-18DC-4BF5-A703-7F19DA88DC30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F4C9BCF-9C73-4991-B02F-E08C5DA06EBA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "2823789C-2CB6-4300-94DB-BDBE83ABA8E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5416C76-46ED-4CB1-A7F8-F24EA16DE7F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*",
              "matchCriteriaId": "A61429EE-4331-430C-9830-58DCCBCBCB58",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*",
              "matchCriteriaId": "31B3593F-CEDF-423C-90F8-F88EED87DC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE7862B2-E1FA-4E16-92CD-8918AB461D9A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9E03BE3-60CC-4415-B993-D0BB00F87A30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE92E59A-FF0D-4D1A-8B12-CC41A7E1FD3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*",
              "matchCriteriaId": "BFD64FE7-ABAF-49F3-B8D0-91C37C822F4B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F8C62EF-1B67-456A-9C66-755439CF8556",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "33E9607B-4D28-460D-896B-E4B7FA22441E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A819E245-D641-4F19-9139-6C940504F6E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C381275-10C5-4939-BCE3-0D1F3B3CB2EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7205475A-6D04-4042-B24E-1DA5A57029B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "08022987-B36B-4F63-88A5-A8F59195DF4A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF4B7557-EF35-451E-B55D-3296966695AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "8980E61E-27BE-4858-82B3-C0E8128AF521",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "8756BF9B-3E24-4677-87AE-31CE776541F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "88CE057E-2092-4C98-8D0C-75CF439D0A9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F194580-EE6D-4E38-87F3-F0661262256B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9731BAA-4C6C-4259-B786-F577D8A90FA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F74A421-D019-4248-84B8-C70D4D9A8A95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "305688F2-50A6-41FB-8614-BC589DB9A789",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file."
    },
    {
      "lang": "es",
      "value": "Apache Tomcat v5.5.x antes de v5.5.34, v6.0.33 antes de v6.x, v7.x antes de v7.0.17, cuando el MemoryUserDatabase se utiliza, crea entradas del registro que contienen las contrase\u00f1as al encontrar errores en la creaci\u00f3n de usuarios JMX, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura de un archivo de registro."
    }
  ],
  "id": "CVE-2011-2204",
  "lastModified": "2026-04-29T01:13:23.040",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 1.9,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-06-29T17:55:04.177",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://marc.info/?l=bugtraq\u0026m=132215163318824\u0026w=2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44981"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/48308"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/57126"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securitytracker.com/id?1025712"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://support.apple.com/kb/HT5130"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tomcat.apache.org/security-5.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tomcat.apache.org/security-6.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tomcat.apache.org/security-7.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.debian.org/security/2012/dsa-2401"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:156"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.osvdb.org/73429"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.redhat.com/support/errata/RHSA-2011-1845.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/48456"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717013"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68238"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14931"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=132215163318824\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44981"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/48308"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/57126"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1025712"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.apple.com/kb/HT5130"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tomcat.apache.org/security-5.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tomcat.apache.org/security-6.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tomcat.apache.org/security-7.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2012/dsa-2401"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:156"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/73429"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2011-1845.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/48456"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717013"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68238"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14931"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "5.5.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2011-2204"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-13T17:26:44Z",
    "nvd_published_at": "2011-06-29T17:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.\n\nThis issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.",
  "id": "GHSA-c57p-3v2g-w9rg",
  "modified": "2024-02-21T21:32:35Z",
  "published": "2022-05-14T01:17:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2204"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/763a56b45999653ce648a18462b8a826809215b1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat55/commit/8b81c8c869987e35deed04993ecfcf7be27ca298"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2011:1845"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717013"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68238"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/tomcat"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14931"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20110711083618/http://securitytracker.com/id?1025712"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=132215163318824\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT5130"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-5.html"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-6.html"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-7.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2012/dsa-2401"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Insertion of Sensitive Information into Log File in Apache Tomcat"
}

{
  "GSD": {
    "alias": "CVE-2011-2204",
    "description": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.",
    "id": "GSD-2011-2204",
    "references": [
      "https://www.suse.com/security/cve/CVE-2011-2204.html",
      "https://www.debian.org/security/2012/dsa-2401",
      "https://access.redhat.com/errata/RHSA-2012:0682",
      "https://access.redhat.com/errata/RHSA-2012:0681",
      "https://access.redhat.com/errata/RHSA-2012:0680",
      "https://access.redhat.com/errata/RHSA-2012:0679",
      "https://access.redhat.com/errata/RHSA-2011:1845",
      "https://access.redhat.com/errata/RHSA-2011:1780",
      "https://alas.aws.amazon.com/cve/html/CVE-2011-2204.html",
      "https://linux.oracle.com/cve/CVE-2011-2204.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2011-2204"
      ],
      "details": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.",
      "id": "GSD-2011-2204",
      "modified": "2023-12-13T01:19:07.352525Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2011-2204",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "MDVSA-2011:156",
            "refsource": "MANDRIVA",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:156"
          },
          {
            "name": "DSA-2401",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2012/dsa-2401"
          },
          {
            "name": "48308",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/48308"
          },
          {
            "name": "http://support.apple.com/kb/HT5130",
            "refsource": "CONFIRM",
            "url": "http://support.apple.com/kb/HT5130"
          },
          {
            "name": "HPSBUX02860",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "RHSA-2011:1845",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2011-1845.html"
          },
          {
            "name": "http://tomcat.apache.org/security-7.html",
            "refsource": "CONFIRM",
            "url": "http://tomcat.apache.org/security-7.html"
          },
          {
            "name": "HPSBOV02762",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
          },
          {
            "name": "APPLE-SA-2012-02-01-1",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
          },
          {
            "name": "SSRT100627",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=132215163318824\u0026w=2"
          },
          {
            "name": "tomcat-jmx-info-disclosure(68238)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68238"
          },
          {
            "name": "oval:org.mitre.oval:def:19532",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532"
          },
          {
            "name": "1025712",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1025712"
          },
          {
            "name": "http://tomcat.apache.org/security-6.html",
            "refsource": "CONFIRM",
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "name": "57126",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/57126"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=717013",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717013"
          },
          {
            "name": "oval:org.mitre.oval:def:14931",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14931"
          },
          {
            "name": "SSRT100825",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
          },
          {
            "name": "73429",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/73429"
          },
          {
            "name": "http://tomcat.apache.org/security-5.html",
            "refsource": "CONFIRM",
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "44981",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/44981"
          },
          {
            "name": "HPSBUX02725",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=132215163318824\u0026w=2"
          },
          {
            "name": "SSRT101146",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "48456",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/48456"
          },
          {
            "name": "HPSBST02955",
            "refsource": "HP",
            "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[5.5.0,5.5.34),[6.0.0,6.0.33),[7.0.0,7.0.19)",
          "affected_versions": "All versions starting from 5.5.0 before 5.5.34, all versions starting from 6.0.0 before 6.0.33, all versions starting from 7.0.0 before 7.0.19",
          "cvss_v2": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-200",
            "CWE-937"
          ],
          "date": "2022-07-13",
          "description": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.",
          "fixed_versions": [
            "5.5.34",
            "6.0.33",
            "7.0.19"
          ],
          "identifier": "CVE-2011-2204",
          "identifiers": [
            "GHSA-c57p-3v2g-w9rg",
            "CVE-2011-2204"
          ],
          "not_impacted": "All versions before 5.5.0, all versions starting from 5.5.34 before 6.0.0, all versions starting from 6.0.33 before 7.0.0, all versions starting from 7.0.19",
          "package_slug": "maven/org.apache.tomcat/tomcat",
          "pubdate": "2022-05-14",
          "solution": "Upgrade to versions 5.5.34, 6.0.33, 7.0.19 or above.",
          "title": "Exposure of Sensitive Information to an Unauthorized Actor",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2011-2204",
            "https://bugzilla.redhat.com/show_bug.cgi?id=717013",
            "https://exchange.xforce.ibmcloud.com/vulnerabilities/68238",
            "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E",
            "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E",
            "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E",
            "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E",
            "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14931",
            "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532",
            "http://marc.info/?l=bugtraq\u0026m=132215163318824\u0026w=2",
            "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2",
            "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2",
            "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2",
            "http://securitytracker.com/id?1025712",
            "http://support.apple.com/kb/HT5130",
            "http://tomcat.apache.org/security-5.html",
            "http://tomcat.apache.org/security-6.html",
            "http://tomcat.apache.org/security-7.html",
            "http://www.debian.org/security/2012/dsa-2401",
            "http://www.redhat.com/support/errata/RHSA-2011-1845.html",
            "https://github.com/advisories/GHSA-c57p-3v2g-w9rg"
          ],
          "uuid": "c8381efc-334a-4d99-9d4f-a5394f688b1c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2011-2204"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "73429",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://www.osvdb.org/73429"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=717013",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717013"
            },
            {
              "name": "http://tomcat.apache.org/security-6.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://tomcat.apache.org/security-6.html"
            },
            {
              "name": "http://tomcat.apache.org/security-5.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://tomcat.apache.org/security-5.html"
            },
            {
              "name": "http://tomcat.apache.org/security-7.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://tomcat.apache.org/security-7.html"
            },
            {
              "name": "44981",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/44981"
            },
            {
              "name": "1025712",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://securitytracker.com/id?1025712"
            },
            {
              "name": "48456",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/48456"
            },
            {
              "name": "RHSA-2011:1845",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2011-1845.html"
            },
            {
              "name": "MDVSA-2011:156",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:156"
            },
            {
              "name": "http://support.apple.com/kb/HT5130",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://support.apple.com/kb/HT5130"
            },
            {
              "name": "APPLE-SA-2012-02-01-1",
              "refsource": "APPLE",
              "tags": [],
              "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
            },
            {
              "name": "DSA-2401",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2012/dsa-2401"
            },
            {
              "name": "SSRT100627",
              "refsource": "HP",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=132215163318824\u0026w=2"
            },
            {
              "name": "HPSBUX02860",
              "refsource": "HP",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
            },
            {
              "name": "HPSBST02955",
              "refsource": "HP",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
            },
            {
              "name": "57126",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/57126"
            },
            {
              "name": "HPSBOV02762",
              "refsource": "HP",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
            },
            {
              "name": "tomcat-jmx-info-disclosure(68238)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68238"
            },
            {
              "name": "oval:org.mitre.oval:def:19532",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532"
            },
            {
              "name": "oval:org.mitre.oval:def:14931",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14931"
            },
            {
              "name": "48308",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/48308"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.4,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2019-03-25T11:33Z",
      "publishedDate": "2011-06-29T17:55Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat6 packages that fix several security issues and one bug are\nnow available for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer\nPages (JSP) technologies.\n\nAPR (Apache Portable Runtime) as mentioned in the CVE-2011-3190 and\nCVE-2011-2526 descriptions does not refer to APR provided by the apr\npackages. It refers to the implementation of APR provided by the Tomcat\nNative library, which provides support for using APR with Tomcat. This\nlibrary is not shipped with Red Hat Enterprise Linux 6. This update\nincludes fixes for users who have elected to use APR with Tomcat by taking\nthe Tomcat Native library from a different product. Such a configuration is\nnot supported by Red Hat, however.\n\nMultiple flaws were found in the way Tomcat handled HTTP DIGEST\nauthentication. These flaws weakened the Tomcat HTTP DIGEST authentication\nimplementation, subjecting it to some of the weaknesses of HTTP BASIC\nauthentication, for example, allowing remote attackers to perform session\nreplay attacks. (CVE-2011-1184)\n\nA flaw was found in the way the Coyote (org.apache.coyote.ajp.AjpProcessor)\nand APR (org.apache.coyote.ajp.AjpAprProcessor) Tomcat AJP (Apache JServ\nProtocol) connectors processed certain POST requests. An attacker could\nsend a specially-crafted request that would cause the connector to treat\nthe message body as a new request. This allows arbitrary AJP messages to be\ninjected, possibly allowing an attacker to bypass a web application\u0027s\nauthentication checks and gain access to information they would otherwise\nbe unable to access. The JK (org.apache.jk.server.JkCoyoteHandler)\nconnector is used by default when the APR libraries are not present. The JK\nconnector is not affected by this flaw. (CVE-2011-3190)\n\nA flaw was found in the Tomcat MemoryUserDatabase. If a runtime exception\noccurred when creating a new user with a JMX client, that user\u0027s password\nwas logged to Tomcat log files. Note: By default, only administrators have\naccess to such log files. (CVE-2011-2204)\n\nA flaw was found in the way Tomcat handled sendfile request attributes when\nusing the HTTP APR or NIO (Non-Blocking I/O) connector. A malicious web\napplication running on a Tomcat instance could use this flaw to bypass\nsecurity manager restrictions and gain access to files it would otherwise\nbe unable to access, or possibly terminate the Java Virtual Machine (JVM).\nThe HTTP blocking IO (BIO) connector, which is not vulnerable to this\nissue, is used by default in Red Hat Enterprise Linux 6. (CVE-2011-2526)\n\nRed Hat would like to thank the Apache Tomcat project for reporting the\nCVE-2011-2526 issue.\n\nThis update also fixes the following bug:\n\n* Previously, in certain cases, if \"LANG=fr_FR\" or \"LANG=fr_FR.UTF-8\" was\nset as an environment variable or in \"/etc/sysconfig/tomcat6\" on 64-bit\nPowerPC systems, Tomcat may have failed to start correctly. With this\nupdate, Tomcat works as expected when LANG is set to \"fr_FR\" or\n\"fr_FR.UTF-8\". (BZ#748807)\n\nUsers of Tomcat should upgrade to these updated packages, which contain\nbackported patches to correct these issues. Tomcat must be restarted for\nthis update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2011:1780",
        "url": "https://access.redhat.com/errata/RHSA-2011:1780"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "http://tomcat.apache.org/security-6.html",
        "url": "http://tomcat.apache.org/security-6.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/support/offerings/production/soc.html",
        "url": "https://access.redhat.com/support/offerings/production/soc.html"
      },
      {
        "category": "external",
        "summary": "717013",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717013"
      },
      {
        "category": "external",
        "summary": "720948",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=720948"
      },
      {
        "category": "external",
        "summary": "734868",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=734868"
      },
      {
        "category": "external",
        "summary": "741401",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=741401"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1780.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat6 security and bug fix update",
    "tracking": {
      "current_release_date": "2026-01-28T22:34:18+00:00",
      "generator": {
        "date": "2026-01-28T22:34:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.16"
        }
      },
      "id": "RHSA-2011:1780",
      "initial_release_date": "2011-12-05T17:39:00+00:00",
      "revision_history": [
        {
          "date": "2011-12-05T17:39:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2011-12-05T17:46:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-01-28T22:34:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-6.1.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Optional (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Optional (v. 6)",
                  "product_id": "6Server-optional-6.1.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-lib-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-lib-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-lib-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-lib@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
                "product": {
                  "name": "tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
                  "product_id": "tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.24-35.el6_1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat6-0:6.0.24-35.el6_1.src",
                "product": {
                  "name": "tomcat6-0:6.0.24-35.el6_1.src",
                  "product_id": "tomcat6-0:6.0.24-35.el6_1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat6@6.0.24-35.el6_1?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-35.el6_1.src as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src"
        },
        "product_reference": "tomcat6-0:6.0.24-35.el6_1.src",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-0:6.0.24-35.el6_1.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src"
        },
        "product_reference": "tomcat6-0:6.0.24-35.el6_1.src",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-javadoc-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-lib-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-lib-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat6-webapps-0:6.0.24-35.el6_1.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
          "product_id": "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        },
        "product_reference": "tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
        "relates_to_product_reference": "6Server-optional-6.1.z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2011-1184",
      "discovery_date": "2011-09-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "741401"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Multiple weaknesses in HTTP DIGEST authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-1184"
        },
        {
          "category": "external",
          "summary": "RHBZ#741401",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=741401"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-1184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-1184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-1184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1184"
        }
      ],
      "release_date": "2011-09-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2011-12-05T17:39:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259",
          "product_ids": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1780"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Multiple weaknesses in HTTP DIGEST authentication"
    },
    {
      "cve": "CVE-2011-2204",
      "discovery_date": "2011-06-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "717013"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: password disclosure vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Security Response Team has rated this issue as having low security\nimpact, a future update may address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-2204"
        },
        {
          "category": "external",
          "summary": "RHBZ#717013",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=717013"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-2204",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-2204"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-2204",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2204"
        }
      ],
      "release_date": "2011-06-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2011-12-05T17:39:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259",
          "product_ids": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1780"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: password disclosure vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Apache Tomcat project"
          ]
        }
      ],
      "cve": "CVE-2011-2526",
      "discovery_date": "2011-07-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "720948"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: security manager restrictions bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Security Response Team has rated this issue as having low security\nimpact, a future update may address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-2526"
        },
        {
          "category": "external",
          "summary": "RHBZ#720948",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=720948"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-2526",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-2526"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-2526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2526"
        }
      ],
      "release_date": "2011-07-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2011-12-05T17:39:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259",
          "product_ids": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1780"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:H/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: security manager restrictions bypass"
    },
    {
      "cve": "CVE-2011-3190",
      "discovery_date": "2011-08-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "734868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: authentication bypass and information disclosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-3190"
        },
        {
          "category": "external",
          "summary": "RHBZ#734868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=734868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-3190",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-3190"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-3190",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3190"
        }
      ],
      "release_date": "2011-08-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2011-12-05T17:39:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259",
          "product_ids": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1780"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: authentication bypass and information disclosure"
    },
    {
      "cve": "CVE-2011-5062",
      "discovery_date": "2011-09-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "741401"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Multiple weaknesses in HTTP DIGEST authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-5062"
        },
        {
          "category": "external",
          "summary": "RHBZ#741401",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=741401"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-5062",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-5062"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-5062",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5062"
        }
      ],
      "release_date": "2011-09-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2011-12-05T17:39:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259",
          "product_ids": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1780"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Multiple weaknesses in HTTP DIGEST authentication"
    },
    {
      "cve": "CVE-2011-5063",
      "discovery_date": "2011-09-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "741401"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Multiple weaknesses in HTTP DIGEST authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-5063"
        },
        {
          "category": "external",
          "summary": "RHBZ#741401",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=741401"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-5063",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-5063"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-5063",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5063"
        }
      ],
      "release_date": "2011-09-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2011-12-05T17:39:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259",
          "product_ids": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1780"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Multiple weaknesses in HTTP DIGEST authentication"
    },
    {
      "cve": "CVE-2011-5064",
      "discovery_date": "2011-09-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "741401"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Multiple weaknesses in HTTP DIGEST authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
          "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
          "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-5064"
        },
        {
          "category": "external",
          "summary": "RHBZ#741401",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=741401"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-5064",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-5064"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-5064",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5064"
        }
      ],
      "release_date": "2011-09-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2011-12-05T17:39:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259",
          "product_ids": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2011:1780"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-0:6.0.24-35.el6_1.src",
            "6Server-optional-6.1.z:tomcat6-admin-webapps-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-docs-webapp-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-el-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-javadoc-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-jsp-2.1-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-lib-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-servlet-2.5-api-0:6.0.24-35.el6_1.noarch",
            "6Server-optional-6.1.z:tomcat6-webapps-0:6.0.24-35.el6_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Multiple weaknesses in HTTP DIGEST authentication"
    }
  ]
}