Improper Certificate Validation The advisory has been revoked - it doesn't affect any version of package tomcat-native (opens in a new tab)

Threat Intelligence

4.15% (91^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU2004-TOMCATNATIVE-645407
published31 Jul 2018
disclosed31 Jul 2018

Report a new vulnerability Found a mistake?

Introduced: 31 Jul 2018

CVE-2018-8020 (opens in a new tab) CWE-295 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:20.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat-native package and not the tomcat-native package as distributed by Ubuntu.

Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.