|Description||Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||low (attack range: remote)|
Vulnerable and fixed packages
The table below lists information on source packages.
|tomcat6 (PTS)||jessie (security), jessie||6.0.45+dfsg-1~deb8u1||fixed|
The information below is based on the following data on fixed versions.
Negligable information disclosure