PT-2018-18384 · Apache+2 · Apache Tomcat Native+2

Coty Sutherland · Published 2018-07-31 · Updated 2021-09-23 · CVE-2018-8019

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat Native versions 1.1.23 through 1.1.34 Apache Tomcat Native versions 1.2.0 through 1.2.16

Description: The issue arises when using an OCSP responder, where Apache Tomcat Native did not correctly handle invalid responses. This led to revoked client certificates being incorrectly identified, allowing users to authenticate with revoked certificates when using mutual TLS.

Recommendations: For Apache Tomcat Native versions 1.1.23 through 1.1.34, update to a version that correctly handles OCSP responses to prevent authentication with revoked certificates. For Apache Tomcat Native versions 1.2.0 through 1.2.16, update to a version that correctly handles OCSP responses to prevent authentication with revoked certificates. As a temporary workaround, consider disabling OCSP checks until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2019-1916

ALT-PU-2021-2859

CVE-2018-8019

DLA-1475-1

MGASA-2019-0184

RHSA-2018:2469

SUSE-SU-2019:14014-1

SUSE-SU-2019_14014-1

Affected Products

Alt Linux

Apache Tomcat Native

Suse

References · 31

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8019 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-8019 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0184 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8019 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-8019 · Security Note
• https://ubuntu.com/security/CVE-2018-8019 · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180721095943.GA24320%40minotaur.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1475-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2470 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14014-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0184.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-8019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8019 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=24755 · Note