PT-2018-2982 · Apache+7 · Apache Tomcat+7

Published 2018-06-26 · Updated 2024-10-21 · CVE-2018-8034

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.35 through 7.0.88 Apache Tomcat versions 8.0.0.RC1 through 8.0.52 Apache Tomcat versions 8.5.0 through 8.5.31 Apache Tomcat versions 9.0.0.M1 through 9.0.9

Description The issue is related to the host name verification when using TLS with the WebSocket client, which was missing and is now enabled by default. This allows a remote attacker to bypass existing security restrictions by exploiting errors in host name checking during Transport Layer Security (TLS) protocol use.

Recommendations For Apache Tomcat versions 7.0.35 through 7.0.88, enable host name verification for the WebSocket client. For Apache Tomcat versions 8.0.0.RC1 through 8.0.52, enable host name verification for the WebSocket client. For Apache Tomcat versions 8.5.0 through 8.5.31, enable host name verification for the WebSocket client. For Apache Tomcat versions 9.0.0.M1 through 9.0.9, enable host name verification for the WebSocket client.

Exploit

Fix

Improper Certificate Validation

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-295

CWE-358

Related Identifiers

ALSA-2019:1529

ALT-PU-2019-1516

BDU:2019-03108

CESA-2019_1529

CESA-2019_2205

CVE-2018-8034

DLA-1453-1

DLA-1491-1

DSA-4281-1

GHSA-46J3-R4PJ-4835

MGASA-2018-0479

OPENSUSE-SU-2018_2740-1

OPENSUSE-SU-2018_3054-1

OPENSUSE-SU-2024:11468-1

OPENSUSE-SU-2024:13441-1

RHSA-2019:0131

RHSA-2019:0451

RHSA-2019:1159

RHSA-2019:1160

RHSA-2019:1161

RHSA-2019:1529

RHSA-2019:2205

RHSA-2019_1529

RHSA-2019_2205

RLSA-2019:1529

SUSE-SU-2018:2699-1

SUSE-SU-2018:3011-1

SUSE-SU-2018:3261-1

SUSE-SU-2018:3388-1

USN-3723-1

Affected Products

Alt Linux

Almalinux

Apache Tomcat

Centos

Red Hat

Rocky Linux

Suse

Ubuntu

References · 177

• 🔥 https://github.com/Pa55w0rd/CVE-2018-1305 · Exploit
• 🔥 https://github.com/knqyf263/CVE-2018-1304 · Exploit
• https://errata.almalinux.org/8/ALSA-2019-1529.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0130 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2019:1529 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0479 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3388-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4281 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2019:1529 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0131 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4281-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1160 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0451 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1336 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1162 · Vendor Advisory