Unrated

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for re...

CVE-2018-8019 First seen on SecPulse Jul 31, 2018

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2018-8019 tomcat-native Fixed in: 1.2.17-1

Original description The description as published by the source.

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

Key facts

Severity: Unrated
Published: Jul 31, 2018
First seen on SecPulse: Jul 31, 2018

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 19:50