High severity · published Jul 31, 2018
CVE-2018-8020
Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate…
7.4
CVSS
4.1%
EPSS
No
On KEV
Description
Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
8.0 · source: NVD
TN
Tomcat Native · Apache
1.1.23 through 1.1.34; 1.2.0 through 1.2.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8020
mail-archives.us.apache.org
http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180721101944.GA45239%40minotaur.apache.org%3E
Third Party Advisory
http://www.securityfocus.com/bid/104934
Third Party Advisory
http://www.securitytracker.com/id/1041507
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2469
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2470
lists.apache.org
https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
More from Tomcat Native
9.1
CVE-2026-86246
Apache Tomcat Native: Insecure OpenSSL options enabled
9.1
CVE-2026-29145
Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
7.5
CVE-2026-86243
Apache Tomcat Native: DoS via TLS handshake
7.5
CVE-2026-24734
Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
7.4
CVE-2026-86247
Apache Tomcat Native: Client certificate requirements can be down-graded