CVE-2018-8019

State: Published
Severity: Not scored
Published: Jul 31, 2018
Updated: Sep 16, 2024
Reserved: Mar 9, 2018

Description

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache Tomcat NativeApache Software Foundation	1.2.0 to 1.2.16Affected 1.1.23 to 1.1.34Affected

References

[www-announce] 20180721 [SECURITY] CVE-2018-8019 Apache Tomcat Native Connector - Mishandled OCSP invalid responsemailing-list
104936vdb-entry
RHSA-2018:2469vendor-advisory
[debian-lts-announce] 20180822 [SECURITY] [DLA 1475-1] tomcat-native security updatemailing-list
RHSA-2018:2470vendor-advisory
1041507vdb-entry
[tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/mailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.