CVE-2007-1858

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.28 through 4.1.31 Apache Tomcat versions 5.0.0 through 5.0.30 Apache Tomcat versions 5.5.0 through 5.5.17

Description: The default SSL cipher configuration uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information. The issue is related to the default SSL configuration permitting the use of insecure cipher suites.

Recommendations: For Apache Tomcat versions 4.1.28 through 4.1.31, update the SSL cipher configuration to exclude insecure ciphers. For Apache Tomcat versions 5.0.0 through 5.0.30, update the SSL cipher configuration to exclude insecure ciphers. For Apache Tomcat versions 5.5.0 through 5.5.17, update the SSL cipher configuration to exclude insecure ciphers.