High severity · published Jul 31, 2018
CVE-2018-8019
When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses
7.4
CVSS
4%
EPSS
No
On KEV
Description
When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
8.0 · source: NVD
TN
Tomcat Native · Apache
1.1.23 through 1.1.34; 1.2.0 through 1.2.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8019
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8019
Mitigation
http://mail-archives.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180721095943.GA24320%40minotaur.apache.org%3E
Third Party Advisory
http://www.securityfocus.com/bid/104936
Third Party Advisory
http://www.securitytracker.com/id/1041507
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2469
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2470
lists.apache.org
https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
More from Tomcat Native
9.1
CVE-2026-86246
Apache Tomcat Native: Insecure OpenSSL options enabled
9.1
CVE-2026-29145
Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
7.5
CVE-2026-86243
Apache Tomcat Native: DoS via TLS handshake
7.5
CVE-2026-24734
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat
7.4
CVE-2026-86247
Apache Tomcat Native: Client certificate requirements can be down-graded