Improper Certificate Validation The advisory has been revoked - it doesn't affect any version of package tomcat-native (opens in a new tab)

Threat Intelligence

4.02% (91^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU2004-TOMCATNATIVE-645416
published31 Jul 2018
disclosed31 Jul 2018

Report a new vulnerability Found a mistake?

Introduced: 31 Jul 2018

CVE-2018-8019 (opens in a new tab) CWE-295 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:20.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat-native package and not the tomcat-native package as distributed by Ubuntu.

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.