Skip to content
Fencer Intel
medium 4.3

CVE-2011-5064 json

Use of Hard-coded Cryptographic Key in Apache Tomcat

published 2012-01-14 14 y ago modified 2026-06-16 4 mo ago also GHSA-6cr4-7c7p-p3xv , EUVD-2022-2773

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.3%
EPSS 6.3% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.

Patch / fix

  • maven org.apache.tomcat:tomcat 5.5.34, 6.0.33, 7.0.12
  • tomcat6 jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
  • tomcat6 jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
  • tomcat6-lib jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
  • tomcat6-lib jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
  • tomcat6-log4j jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
  • tomcat6-log4j jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
  • tomcat6-javadoc jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
  • tomcat6-javadoc jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6

red hat advisories RHSA-2012:0682RHSA-2012:0076RHSA-2012:0074RHSA-2012:0680RHSA-2011:1845RHSA-2011:1780

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-5064 updated cvss 4.3

tomcat: Multiple weaknesses in HTTP DIGEST authentication

  • Red Hat JBoss Communications Platform 5.1
    fixed: vendor fix RHSA-2012:0078
  • Red Hat JBoss Enterprise BRMS Platform 5.1
    fixed: vendor fix RHSA-2012:0325
  • Red Hat Enterprise Linux (v. 5 server) tomcat5 5.5.23-0jpp.22.el5_7, tomcat5-jasper 5.5.23-0jpp.22.el5_7, tomcat5-webapps 5.5.23-0jpp.22.el5_7, tomcat5-common-lib 5.5.23-0jpp.22.el5_7, tomcat5-server-lib 5.5.23-0jpp.22.el5_7, tomcat5-jsp-2.0-api 5.5.23-0jpp.22.el5_7, +5 more Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5 5.5.23-0jpp.22.el5_7, tomcat5-jsp-2.0-api 5.5.23-0jpp.22.el5_7, tomcat5-servlet-2.4-api 5.5.23-0jpp.22.el5_7
    fixed: vendor fix RHSA-2011:1845
  • Red Hat Enterprise Linux Server (v. 6) tomcat6 6.0.24-35.el6_1, tomcat6-lib 6.0.24-35.el6_1, tomcat6-el-2.1-api 6.0.24-35.el6_1, tomcat6-jsp-2.1-api 6.0.24-35.el6_1, tomcat6-servlet-2.5-api 6.0.24-35.el6_1 Red Hat Enterprise Linux Server Optional (v. 6) tomcat6 6.0.24-35.el6_1, tomcat6-javadoc 6.0.24-35.el6_1, tomcat6-webapps 6.0.24-35.el6_1, tomcat6-docs-webapp 6.0.24-35.el6_1, tomcat6-admin-webapps 6.0.24-35.el6_1
    fixed: vendor fix RHSA-2011:1780
  • Red Hat JBoss Enterprise Application Platform 4.3
    fixed: vendor fix RHSA-2012:0041
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jbossweb 2.1.12-3_patch_03.2.ep5.el5, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el5, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jbossweb 2.1.12-3_patch_03.2.ep5.el6, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el6, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el6
    fixed: vendor fix RHSA-2012:0074
  • Red Hat JBoss Enterprise Application Platform 5.1
    fixed: vendor fix RHSA-2012:0075
  • Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server tomcat5 5.5.33-27_patch_07.ep5.el5, tomcat6 6.0.32-24_patch_07.ep5.el5, tomcat6-lib 6.0.32-24_patch_07.ep5.el5, tomcat6-log4j 6.0.32-24_patch_07.ep5.el5, tomcat5-jasper 5.5.33-27_patch_07.ep5.el5, tomcat5-parent 5.5.33-27_patch_07.ep5.el5, +17 more Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server tomcat5 5.5.33-28_patch_07.ep5.el6, tomcat6 6.0.32-24_patch_07.ep5.el6, tomcat6-lib 6.0.32-24_patch_07.ep5.el6, tomcat6-log4j 6.0.32-24_patch_07.ep5.el6, tomcat5-jasper 5.5.33-28_patch_07.ep5.el6, tomcat5-parent 5.5.33-28_patch_07.ep5.el6, +17 more
    fixed: vendor fix RHSA-2012:0680
show 7 more
  • Red Hat JBoss Portal 4.3
    fixed: vendor fix RHSA-2012:0091
  • Red Hat JBoss Portal 5.2 Red Hat JBoss SOA Platform 5.2
    fixed: vendor fix RHSA-2012:0325
  • Red Hat JBoss Web Platform 5 for RHEL 5 Server jbossweb 2.1.12-3_patch_03.2.ep5.el5, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el5, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el5 Red Hat JBoss Web Platform 5 for RHEL 6 Server jbossweb 2.1.12-3_patch_03.2.ep5.el6, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el6, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el6
    fixed: vendor fix RHSA-2012:0076
  • Red Hat JBoss Web Platform 5.1
    fixed: vendor fix RHSA-2012:0077
  • Red Hat JBoss Web Server 1.0
    fixed: vendor fix RHSA-2012:0679
  • Red Hat RHEL Desktop Workstation (v. 5 client) tomcat5 5.5.23-0jpp.22.el5_7, tomcat5-jasper 5.5.23-0jpp.22.el5_7, tomcat5-webapps 5.5.23-0jpp.22.el5_7, tomcat5-common-lib 5.5.23-0jpp.22.el5_7, tomcat5-server-lib 5.5.23-0jpp.22.el5_7, tomcat5-admin-webapps 5.5.23-0jpp.22.el5_7, +3 more
    fixed: vendor fix RHSA-2011:1845
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Web Platform 5 for RHEL 4 ES jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.33% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat:tomcat
>=5.5.0, <5.5.34
>=6.0.0, <6.0.33
>=7.0.0, <7.0.12
5.5.34
6.0.33
7.0.12

Classification

Weakness
  • CWE-310 Cryptographic Issues
  • CWE-321 Use of Hard-coded Cryptographic Key

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.