製品・ソフトウェアに関する情報

JVN脆弱性詳細

Apache Tomcat におけるアクセス制限を回避される脆弱性

Title	Apache Tomcat におけるアクセス制限を回避される脆弱性
Summary	Apache Tomcat の HTTP Digest Access Authentication の実装は、適切な認証情報の確認の際に、失効した nonce 値を適切に確認しないため、アクセス制限を回避される脆弱性が存在します。
Possible impacts	第三者により、有効なリクエストに対するネットワークを傍受されることで、アクセス制限を回避される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 5, 2012, midnight
Registration Date	Nov. 20, 2012, 11:18 a.m.
Last Update	Feb. 16, 2016, 1:52 p.m.

CVSS2.0 : 警告
Score	5
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected System

Apache Software Foundation

Apache Tomcat 5.5.36 未満の 5.5.x

Apache Tomcat 6.0.36 未満の 6.x

Apache Tomcat 7.0.30 未満の 7.x

Apache Tomcat 5.5.36 未満の 5.5.x

Apache Tomcat 6.0.36 未満の 6.x

Apache Tomcat 7.0.30 未満の 7.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-5887	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5887
2	CVE-2012-5887	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5887
National Vulnerability Database (NVD)
3	CVE-2012-5887	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5887
4	CVE-2012-5887	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5887

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html
2	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html

ベンダー情報

No	Name	URL
Apache Tomcat
1	Fixed in Apache Tomcat 5.5.36	http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.36
2	Fixed in Apache Tomcat 5.5.36	http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.36
3	Fixed in Apache Tomcat 6.0.36	http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36
4	Fixed in Apache Tomcat 6.0.36	http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36
5	Fixed in Apache Tomcat 7.0.30	http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.30
6	Fixed in Apache Tomcat 7.0.30	http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.30
Apache-SVN
7	Revision 1377807	http://svn.apache.org/viewvc?view=revision&revision=1377807
8	Revision 1377807	http://svn.apache.org/viewvc?view=revision&revision=1377807
9	Revision 1380829	http://svn.apache.org/viewvc?view=revision&revision=1380829
10	Revision 1380829	http://svn.apache.org/viewvc?view=revision&revision=1380829
11	Revision 1392248	http://svn.apache.org/viewvc?view=revision&revision=1392248
12	Revision 1392248	http://svn.apache.org/viewvc?view=revision&revision=1392248
IBM セキュリティー情報
13	1626891	http://www-01.ibm.com/support/docview.wss?uid=swg21626891
14	1626891	http://www-01.ibm.com/support/docview.wss?uid=swg21626891
Red Hat Security Advisory
15	RHSA-2013:0623	https://rhn.redhat.com/errata/RHSA-2013-0623.html
16	RHSA-2013:0623	https://rhn.redhat.com/errata/RHSA-2013-0623.html
17	RHSA-2013:0629	https://rhn.redhat.com/errata/RHSA-2013-0629.html
18	RHSA-2013:0629	https://rhn.redhat.com/errata/RHSA-2013-0629.html
19	RHSA-2013:0631	https://rhn.redhat.com/errata/RHSA-2013-0631.html
20	RHSA-2013:0631	https://rhn.redhat.com/errata/RHSA-2013-0631.html
21	RHSA-2013:0632	https://rhn.redhat.com/errata/RHSA-2013-0632.html
22	RHSA-2013:0632	https://rhn.redhat.com/errata/RHSA-2013-0632.html
23	RHSA-2013:0633	https://rhn.redhat.com/errata/RHSA-2013-0633.html
24	RHSA-2013:0633	https://rhn.redhat.com/errata/RHSA-2013-0633.html
25	RHSA-2013:0640	https://rhn.redhat.com/errata/RHSA-2013-0640.html
26	RHSA-2013:0640	https://rhn.redhat.com/errata/RHSA-2013-0640.html
27	RHSA-2013:0647	https://rhn.redhat.com/errata/RHSA-2013-0647.html
28	RHSA-2013:0647	https://rhn.redhat.com/errata/RHSA-2013-0647.html
29	RHSA-2013:0648	https://rhn.redhat.com/errata/RHSA-2013-0648.html
30	RHSA-2013:0648	https://rhn.redhat.com/errata/RHSA-2013-0648.html
31	RHSA-2013:0726	https://rhn.redhat.com/errata/RHSA-2013-0726.html
32	RHSA-2013:0726	https://rhn.redhat.com/errata/RHSA-2013-0726.html
SECURITY BLOG
33	Multiple vulnerabilities in Apache Tomcat	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_apache_tomcat3
34	Multiple vulnerabilities in Apache Tomcat	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_apache_tomcat3
Ubuntu Security Notice
35	USN-1637-1	http://www.ubuntu.com/usn/USN-1637-1/
36	USN-1637-1	http://www.ubuntu.com/usn/USN-1637-1/

Change Log

No	Changed Details	Date of change
0	[2012年11月20日] 掲載 [2012年12月26日] ベンダ情報：Ubuntu (USN-1637-1) を追加 [2013年03月08日] ベンダ情報：オラクル (Multiple vulnerabilities in Apache Tomcat) を追加 [2016年02月16日] ベンダ情報：レッドハット (RHSA-2013:0623) を追加ベンダ情報：レッドハット (RHSA-2013:0629) を追加ベンダ情報：レッドハット (RHSA-2013:0631) を追加ベンダ情報：レッドハット (RHSA-2013:0632) を追加ベンダ情報：レッドハット (RHSA-2013:0726) を追加ベンダ情報：レッドハット (RHSA-2013:0648) を追加ベンダ情報：レッドハット (RHSA-2013:0647) を追加ベンダ情報：レッドハット (RHSA-2013:0640) を追加ベンダ情報：レッドハット (RHSA-2013:0633) を追加ベンダ情報：IBM (1626891) を追加	Feb. 17, 2018, 10:37 a.m.
0	[2012年11月20日] 掲載 [2012年12月26日] ベンダ情報：Ubuntu (USN-1637-1) を追加 [2013年03月08日] ベンダ情報：オラクル (Multiple vulnerabilities in Apache Tomcat) を追加 [2016年02月16日] ベンダ情報：レッドハット (RHSA-2013:0623) を追加ベンダ情報：レッドハット (RHSA-2013:0629) を追加ベンダ情報：レッドハット (RHSA-2013:0631) を追加ベンダ情報：レッドハット (RHSA-2013:0632) を追加ベンダ情報：レッドハット (RHSA-2013:0726) を追加ベンダ情報：レッドハット (RHSA-2013:0648) を追加ベンダ情報：レッドハット (RHSA-2013:0647) を追加ベンダ情報：レッドハット (RHSA-2013:0640) を追加ベンダ情報：レッドハット (RHSA-2013:0633) を追加ベンダ情報：IBM (1626891) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-5887

Summary	The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Publication Date	Nov. 18, 2012, 4:55 a.m.
Registration Date	Jan. 28, 2021, 3:06 p.m.
Last Update	Nov. 21, 2024, 10:45 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:5.5.27:::::::*
cpe:2.3:a:apache:tomcat:5.5.18:::::::*
cpe:2.3:a:apache:tomcat:5.5.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.14:::::::*
cpe:2.3:a:apache:tomcat:5.5.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.1:::::::*
cpe:2.3:a:apache:tomcat:5.5.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.28:::::::*
cpe:2.3:a:apache:tomcat:5.5.6:::::::*
cpe:2.3:a:apache:tomcat:5.5.26:::::::*
cpe:2.3:a:apache:tomcat:5.5.35:::::::*
cpe:2.3:a:apache:tomcat:5.5.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.15:::::::*
cpe:2.3:a:apache:tomcat:5.5.5:::::::*
cpe:2.3:a:apache:tomcat:5.5.30:::::::*
cpe:2.3:a:apache:tomcat:5.5.21:::::::*
cpe:2.3:a:apache:tomcat:5.5.22:::::::*
cpe:2.3:a:apache:tomcat:5.5.3:::::::*
cpe:2.3:a:apache:tomcat:5.5.32:::::::*
cpe:2.3:a:apache:tomcat:5.5.31:::::::*
cpe:2.3:a:apache:tomcat:5.5.9:::::::*
cpe:2.3:a:apache:tomcat:5.5.25:::::::*
cpe:2.3:a:apache:tomcat:5.5.33:::::::*
cpe:2.3:a:apache:tomcat:5.5.2:::::::*
cpe:2.3:a:apache:tomcat:5.5.0:::::::*
cpe:2.3:a:apache:tomcat:5.5.13:::::::*
cpe:2.3:a:apache:tomcat:5.5.24:::::::*
cpe:2.3:a:apache:tomcat:5.5.34:::::::*
cpe:2.3:a:apache:tomcat:5.5.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.16:::::::*
cpe:2.3:a:apache:tomcat:5.5.17:::::::*
cpe:2.3:a:apache:tomcat:5.5.29:::::::*
cpe:2.3:a:apache:tomcat:5.5.19:::::::*
cpe:2.3:a:apache:tomcat:5.5.23:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:6.0.33:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:6.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:beta::::::
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.31:::::::*
cpe:2.3:a:apache:tomcat:6.0.29:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.7:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.24:::::::*
cpe:2.3:a:apache:tomcat:6.0.17:::::::*
cpe:2.3:a:apache:tomcat:6.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.32:::::::*
cpe:2.3:a:apache:tomcat:6.0.28:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.6:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:6.0.18:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:beta::::::
cpe:2.3:a:apache:tomcat:6.0.30:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:beta::::::
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.26:::::::*
cpe:2.3:a:apache:tomcat:6.0.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.27:::::::*
cpe:2.3:a:apache:tomcat:6.0.35:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:7.0.8:::::::*
cpe:2.3:a:apache:tomcat:7.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:tomcat:7.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:7.0.7:::::::*
cpe:2.3:a:apache:tomcat:7.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.15:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.9:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.3:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
2	http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
3	http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
4	http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
5	http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
6	http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
7	http://rhn.redhat.com/errata/RHSA-2013-0623.html
8	http://rhn.redhat.com/errata/RHSA-2013-0623.html
9	http://rhn.redhat.com/errata/RHSA-2013-0629.html
10	http://rhn.redhat.com/errata/RHSA-2013-0629.html
11	http://rhn.redhat.com/errata/RHSA-2013-0631.html
12	http://rhn.redhat.com/errata/RHSA-2013-0631.html
13	http://rhn.redhat.com/errata/RHSA-2013-0632.html
14	http://rhn.redhat.com/errata/RHSA-2013-0632.html
15	http://rhn.redhat.com/errata/RHSA-2013-0633.html
16	http://rhn.redhat.com/errata/RHSA-2013-0633.html
17	http://rhn.redhat.com/errata/RHSA-2013-0640.html
18	http://rhn.redhat.com/errata/RHSA-2013-0640.html
19	http://rhn.redhat.com/errata/RHSA-2013-0647.html
20	http://rhn.redhat.com/errata/RHSA-2013-0647.html
21	http://rhn.redhat.com/errata/RHSA-2013-0648.html
22	http://rhn.redhat.com/errata/RHSA-2013-0648.html
23	http://rhn.redhat.com/errata/RHSA-2013-0726.html
24	http://rhn.redhat.com/errata/RHSA-2013-0726.html
25	http://secunia.com/advisories/51371
26	http://secunia.com/advisories/51371
27	http://svn.apache.org/viewvc?view=revision&revision=1377807
28	http://svn.apache.org/viewvc?view=revision&revision=1377807
29	http://svn.apache.org/viewvc?view=revision&revision=1380829
30	http://svn.apache.org/viewvc?view=revision&revision=1380829
31	http://svn.apache.org/viewvc?view=revision&revision=1392248
32	http://svn.apache.org/viewvc?view=revision&revision=1392248
33	http://tomcat.apache.org/security-5.html	Vendor Advisory
34	http://tomcat.apache.org/security-5.html	Vendor Advisory
35	http://tomcat.apache.org/security-6.html	Vendor Advisory
36	http://tomcat.apache.org/security-6.html	Vendor Advisory
37	http://tomcat.apache.org/security-7.html	Vendor Advisory
38	http://tomcat.apache.org/security-7.html	Vendor Advisory
39	http://www.securityfocus.com/bid/56403
40	http://www.securityfocus.com/bid/56403
41	http://www.ubuntu.com/usn/USN-1637-1
42	http://www.ubuntu.com/usn/USN-1637-1
43	http://www-01.ibm.com/support/docview.wss?uid=swg21626891
44	http://www-01.ibm.com/support/docview.wss?uid=swg21626891
45	https://exchange.xforce.ibmcloud.com/vulnerabilities/79809
46	https://exchange.xforce.ibmcloud.com/vulnerabilities/79809

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:5.5.27:::::::*
cpe:2.3:a:apache:tomcat:5.5.18:::::::*
cpe:2.3:a:apache:tomcat:5.5.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.14:::::::*
cpe:2.3:a:apache:tomcat:5.5.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.1:::::::*
cpe:2.3:a:apache:tomcat:5.5.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.28:::::::*
cpe:2.3:a:apache:tomcat:5.5.6:::::::*
cpe:2.3:a:apache:tomcat:5.5.26:::::::*
cpe:2.3:a:apache:tomcat:5.5.35:::::::*
cpe:2.3:a:apache:tomcat:5.5.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.15:::::::*
cpe:2.3:a:apache:tomcat:5.5.5:::::::*
cpe:2.3:a:apache:tomcat:5.5.30:::::::*
cpe:2.3:a:apache:tomcat:5.5.21:::::::*
cpe:2.3:a:apache:tomcat:5.5.22:::::::*
cpe:2.3:a:apache:tomcat:5.5.3:::::::*
cpe:2.3:a:apache:tomcat:5.5.32:::::::*
cpe:2.3:a:apache:tomcat:5.5.31:::::::*
cpe:2.3:a:apache:tomcat:5.5.9:::::::*
cpe:2.3:a:apache:tomcat:5.5.25:::::::*
cpe:2.3:a:apache:tomcat:5.5.33:::::::*
cpe:2.3:a:apache:tomcat:5.5.2:::::::*
cpe:2.3:a:apache:tomcat:5.5.0:::::::*
cpe:2.3:a:apache:tomcat:5.5.13:::::::*
cpe:2.3:a:apache:tomcat:5.5.24:::::::*
cpe:2.3:a:apache:tomcat:5.5.34:::::::*
cpe:2.3:a:apache:tomcat:5.5.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.16:::::::*
cpe:2.3:a:apache:tomcat:5.5.17:::::::*
cpe:2.3:a:apache:tomcat:5.5.29:::::::*
cpe:2.3:a:apache:tomcat:5.5.19:::::::*
cpe:2.3:a:apache:tomcat:5.5.23:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:6.0.33:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:6.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:beta::::::
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.31:::::::*
cpe:2.3:a:apache:tomcat:6.0.29:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.7:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.24:::::::*
cpe:2.3:a:apache:tomcat:6.0.17:::::::*
cpe:2.3:a:apache:tomcat:6.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.32:::::::*
cpe:2.3:a:apache:tomcat:6.0.28:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.6:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:6.0.18:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:beta::::::
cpe:2.3:a:apache:tomcat:6.0.30:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:beta::::::
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.26:::::::*
cpe:2.3:a:apache:tomcat:6.0.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.27:::::::*
cpe:2.3:a:apache:tomcat:6.0.35:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:7.0.8:::::::*
cpe:2.3:a:apache:tomcat:7.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:tomcat:7.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:7.0.7:::::::*
cpe:2.3:a:apache:tomcat:7.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.15:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.9:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.3:::::::*