PT-2018-5976 · Apache+2 · Apache Tomcat Native Connector+2

Jonas Klempel · Published 2018-01-31 · Updated 2019-04-09 · CVE-2017-15698

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat Native Connector versions 1.1.23 through 1.1.34 Apache Tomcat Native Connector versions 1.2.0 through 1.2.14

Description: The issue arises when parsing the AIA-Extension field of a client certificate. If the field is longer than 127 bytes, it is not handled correctly, resulting in the skipping of the OCSP check. This allows client certificates that should be rejected to be accepted, provided that OCSP checks are in use.

Recommendations: For Apache Tomcat Native Connector versions 1.1.23 through 1.1.34, update to a version that correctly handles the AIA-Extension field. For Apache Tomcat Native Connector versions 1.2.0 through 1.2.14, update to a version that correctly handles the AIA-Extension field. As a temporary workaround, consider disabling the use of client certificates that rely on OCSP checks until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2018-1680

CVE-2017-15698

DLA-1276-1

DSA-4118-1

MGASA-2018-0150

RHSA-2018:0466

SUSE-SU-2019:14014-1

SUSE-SU-2019_14014-1

Affected Products

Alt Linux

Apache Tomcat Native Connector

Suse

References · 33

• https://osv.dev/vulnerability/MGASA-2018-0150 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15698 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15698 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0150.html · Security Note
• https://access.redhat.com/errata/RHSA-2018:0466 · Vendor Advisory
• https://debian.org/security/2018/dsa-4118 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/J3AMZRPNW5L27APAWB4IW3SRJQR6HL4G · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4118-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0465 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15698 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15698 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:14014-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15698 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15698 · Vendor Advisory