Homepage

Improper Check for Certificate Revocation Affecting tomcat8-jsp-2.3-api package, versions <0:8.0.36-29.ep7.el7

Severity

 Recommended
high

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.6% (79th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-TOMCAT8JSP23API-3614420
  • published26 Mar 2023
  • disclosed31 Jan 2018
Report a new vulnerability Found a mistake?

Introduced: 31 Jan 2018

CVE-2017-15698  (opens in a new tab)
CWE-299  (opens in a new tab)

How to fix?

Upgrade RHEL:7 tomcat8-jsp-2.3-api to version 0:8.0.36-29.ep7.el7 or higher.
This issue was patched in RHSA-2018:0466.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat8-jsp-2.3-api package and not the tomcat8-jsp-2.3-api package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.

References