CVE-2018-8019 When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identi...
HighCVSS 7.4
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tomcat-native(Debian:12) | < 1.2.17-1 | 1.2.17-1 |
| debian/tomcat-native(Debian:13) | < 1.2.17-1 | 1.2.17-1 |
| debian/tomcat-native(Debian:14) | < 1.2.17-1 | 1.2.17-1 |
| debian linux | = 8.0 | No fix listed |
| apache tomcat native | >= 1.1.23, <= 1.1.34 | No fix listed |
| apache tomcat native | >= 1.2.0, <= 1.2.16 | No fix listed |
| Apache Tomcat Native | = 1.2.0 to 1.2.16 | No fix listed |
| Apache Tomcat Native | = 1.1.23 to 1.1.34 | No fix listed |
References
- Debian Security Tracker CVE-2018-8019 vendor-advisory
- [www-announce] 20180721 [SECURITY] CVE-2018-8019 Apache Tomcat Native Connector - Mishandled OCSP invalid response mailing-list mitigation vendor-advisory
- 104936 third-party-advisory vdb-entry
- 1041507 third-party-advisory vdb-entry
- RHSA-2018:2469 third-party-advisory vendor-advisory
- RHSA-2018:2470 third-party-advisory vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- [debian-lts-announce] 20180822 [SECURITY] [DLA 1475-1] tomcat-native security update mailing-list third-party-advisory