CVE-2013-2051

LowCVSS 2.6/10Last modified Jun 16, 2026

Description

The Tomcat 6 DIGEST authentication functionality as used in Red Hat Enterprise Linux 6 allows remote attackers to bypass intended access restrictions by performing a replay attack after a nonce becomes stale. NOTE: this issue is due to an incomplete fix for CVE-2012-5887.

Metrics

CVSS 2.0 2.6/10AV:N/AC:H/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2013-0869.htmlVendor Advisory
http://www.securityfocus.com/bid/60187
https://bugzilla.redhat.com/show_bug.cgi?id=959047Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0869.htmlVendor Advisory
http://www.securityfocus.com/bid/60187
https://bugzilla.redhat.com/show_bug.cgi?id=959047Vendor Advisory

Timeline

Published: Jul 9, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20525.1Buffer overflow in the atodn function in libreswan 3.0 and 3.1, when Opportunistic Encryption is enabled and an RSA key is being used, allow CVE-2013-20536.8Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allo CVE-2013-20545.1Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being us CVE-2013-20555.0Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain CVE-2013-20567.5A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does no CVE-2013-20579.8YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability CVE-2013-20584.7The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming op CVE-2013-20596.0OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authenticatio CVE-2013-20609.8The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL CVE-2013-20612.6The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive CVE-2013-20626.8Multiple integer overflows in X.org libXp 1.0.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overfl CVE-2013-20636.8Integer overflow in X.org libXtst 1.2.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via