PT-2006-7520 · Apache · Apache Tomcat

Published

2006-04-27

·

Updated

2023-02-13

·

CVE-2007-1858

CVSS v2.0

2.6

Low

VectorAV:N/AC:H/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.28 through 4.1.31 Apache Tomcat versions 5.0.0 through 5.0.30 Apache Tomcat versions 5.5.0 through 5.5.17
Description: The default SSL cipher configuration uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information. The issue is related to the default SSL configuration permitting the use of insecure cipher suites.
Recommendations: For Apache Tomcat versions 4.1.28 through 4.1.31, update the SSL cipher configuration to exclude insecure ciphers. For Apache Tomcat versions 5.0.0 through 5.0.30, update the SSL cipher configuration to exclude insecure ciphers. For Apache Tomcat versions 5.5.0 through 5.5.17, update the SSL cipher configuration to exclude insecure ciphers.

Exploit

Fix

Related Identifiers

CVE-2007-1858
RHSA-2007:0326
RHSA-2007:0340
RHSA-2007:1069

Affected Products

Apache Tomcat