Homepage

Improper Authentication Affecting tomcat8-jsp-2.3-api package, versions <0:8.0.36-31.ep7.el7

Severity

 Recommended
high

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.45% (75th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Authentication vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL7-TOMCAT8JSP23API-3599540
  • published26 Mar 2023
  • disclosed21 Jul 2018
Report a new vulnerability Found a mistake?

Introduced: 21 Jul 2018

CVE-2018-8019  (opens in a new tab)
CWE-287  (opens in a new tab)

How to fix?

Upgrade RHEL:7 tomcat8-jsp-2.3-api to version 0:8.0.36-31.ep7.el7 or higher.
This issue was patched in RHSA-2018:2469.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat8-jsp-2.3-api package and not the tomcat8-jsp-2.3-api package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

References