PT-2018-18385 · Apache+2 · Apache Tomcat Native+2

Crazywen · Published 2018-07-31 · Updated 2021-09-23 · CVE-2018-8020

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat Native versions 1.1.23 through 1.1.34 Apache Tomcat Native versions 1.2.0 through 1.2.16

Description: The issue arises from a flaw in properly checking OCSP pre-produced responses, which are lists of certificate statuses. This flaw can lead to revoked client certificates not being properly identified, allowing users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this issue.

Recommendations: For Apache Tomcat Native versions 1.1.23 through 1.1.34, update to a version that properly checks OCSP pre-produced responses to prevent authentication with revoked certificates. For Apache Tomcat Native versions 1.2.0 through 1.2.16, update to a version that properly checks OCSP pre-produced responses to prevent authentication with revoked certificates. As a temporary workaround, consider disabling OCSP checks until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2019-1916

ALT-PU-2021-2859

CVE-2018-8020

DLA-1475-1

MGASA-2019-0184

RHSA-2018:2469

SUSE-SU-2019:14014-1

SUSE-SU-2019_14014-1

Affected Products

Alt Linux

Apache Tomcat Native

Suse

References · 37

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8020 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-8020 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-8020 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0184 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2469 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8020 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-8020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8020 · Security Note
• https://osv.dev/vulnerability/DLA-1475-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2470 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14014-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0184.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-8020 · Vendor Advisory
• http://securityfocus.com/bid/104934 · Note
• https://bugs.mageia.org/show_bug.cgi?id=24755 · Note