CVE-2018-8019

CWE-295 — Improper Certificate ValidationCWE-287 — Improper Authentication9 documents7 sources
Severity
7.4HIGH
EPSS
0.9%
top 25.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apache Tomcat NativeApache Software Foundation Apache Tomcat NativeDebian Debian Linux
Timeline
PublishedJul 31
Latest updateMay 13

Description

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages3 packages

▶NVDapache/tomcat_native1.1.23 — 1.1.34+1
▶CVEListV5apache_software_foundation/apache_tomcat_native1.1.23 to 1.1.34, 1.2.0 to 1.2.16+1
▶Debiantomcat-native< 1.2.17-1+3

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
GHSA
GHSA-w5fc-h82j-vq6w: When using an OCSP responder Apache Tomcat Native 1↗2022-05-13
▶
OSV
CVE-2018-8019: When using an OCSP responder Apache Tomcat Native 1↗2018-07-31
▶
CVEList
CVE-2018-8019: When using an OCSP responder Apache Tomcat Native 1↗2018-07-31
▶

📋Vendor Advisories

2
Red Hat
tomcat-native: Mishandled OCSP invalid response↗2018-07-21
▶
Debian
CVE-2018-8019: tomcat-native - When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to ...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-8019 tomcat-native: Mishandled OCSP invalid response [fedora-all]↗2018-08-01
▶
Bugzilla
CVE-2018-8019 tomcat-native: Mishandled OCSP invalid response [epel-all]↗2018-08-01
▶
Bugzilla
CVE-2018-8019 tomcat-native: Mishandled OCSP invalid response↗2018-05-30
▶