CVE-2011-5064: Use of Hard-coded Cryptographic Key in Apache Tomcat
Summary
CVE-2011-5064: Use of Hard-coded Cryptographic Key in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 5.5.0, < 5.5.34
>= 6.0.0, < 6.0.33
>= 7.0.0, < 7.0.12
Fixed in 5.5.34, 6.0.33 or 7.0.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java web applications. It provides a Java HTTP web server environment for running Java code. The vulnerability identified as CVE-2011-5064 affects versions 5.5.x, 6.x, and 7.x of Apache Tomcat. This vulnerability is related to the implementation of HTTP Digest Access Authentication in Tomcat. DigestAuthenticator.java, a component of Tomcat, uses a hard-coded server secret (private key) called Catalina. This hard-coded key makes it easier for remote attackers to bypass cryptographic protection mechanisms by exploiting knowledge of this string.
Vulnerability Detail
The vulnerability allows remote attackers to bypass cryptographic protection mechanisms in Apache Tomcat. By leveraging knowledge of the hard-coded server secret (private key) 'Catalina', attackers can circumvent the cryptographic protection provided by the HTTP Digest Access Authentication implementation. This can lead to unauthorized access to protected resources and potential data breaches. It is important to note that this vulnerability is different from CVE-2011-1184.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.345.5.34 -
>= 6.0.0, < 6.0.336.0.33 -
>= 7.0.0, < 7.0.127.0.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The use of a hard-coded cryptographic key in Apache Tomcat's DigestAuthenticator component poses a security risk, allowing remote attackers to bypass cryptographic protection mechanisms. Upgrading to a fixed version of Apache Tomcat is recommended to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java web applications.
HTTP Digest Access Authentication is a method for authenticating users in HTTP applications. It provides a more secure alternative to Basic Authentication by using a challenge-response mechanism.
This vulnerability allows remote attackers to bypass cryptographic protection mechanisms in Apache Tomcat, potentially leading to unauthorized access to protected resources and data breaches.
Yes, upgrading to a fixed version of Apache Tomcat (5.5.34 or later for 5.5.x, 6.0.33 or later for 6.x, and 7.0.12 or later for 7.x) will address this vulnerability.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
