CVE-2018-8019
At a glance
- Severity
- Not available
- EPSS
- EPSS 4.02 % · percentile 91 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2018-19720
- GCVE · GCVE-0-2018-8019
Affected configurations (NVD CPE)
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*≥ 1.1.23 ≤ 1.1.34cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*≥ 1.2.0 ≤ 1.2.16
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat Native | affected 1.2.0 to 1.2.16 ; affected 1.1.23 to 1.1.34 |
References
- http://mail-archives.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180721095943.GA24320%40minotaur.apache.org%3E
- http://www.securityfocus.com/bid/104936
- https://access.redhat.com/errata/RHSA-2018:2469
- https://lists.debian.org/debian-lts-announce/2018/08/msg00023.html
- https://access.redhat.com/errata/RHSA-2018:2470
- http://www.securitytracker.com/id/1041507
- https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |