CVE-2017-15698 When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of t...
MediumCVSS 5.9
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tomcat-native(Debian:12) | < 1.2.16-1 | 1.2.16-1 |
| debian/tomcat-native(Debian:13) | < 1.2.16-1 | 1.2.16-1 |
| debian/tomcat-native(Debian:14) | < 1.2.16-1 | 1.2.16-1 |
| apache tomcat native | >= 1.1.23, <= 1.1.34 | No fix listed |
| apache tomcat native | >= 1.2.0, <= 1.2.14 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Apache Tomcat Native | = 1.2.0 to 1.2.14 | No fix listed |
| Apache Tomcat Native | = 1.1.23 to 1.1.34 | No fix listed |
References
- Debian Security Tracker CVE-2017-15698 vendor-advisory
- 1040390 third-party-advisory vdb-entry
- RHSA-2018:0465 third-party-advisory vendor-advisory
- RHSA-2018:0466 third-party-advisory vendor-advisory
- [announce] 20180131 [SECURITY] CVE-2017-15698 Apache Tomcat Native Connector - OCSP check omitted mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- [debian-lts-announce] 20180211 [SECURITY] [DLA 1276-1] tomcat-native security update mailing-list third-party-advisory
- DSA-4118 third-party-advisory vendor-advisory