Every CVE Search/ Get API key

CVE-2018-8019

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not...

7.4 HighFix available

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

4.05%Down 2.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.4

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Record
CVE-2018-8019
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-295
Updated
2026-11-02
CVE List No score

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Record
CVE-2018-8019
Updated
2026-11-02
EUVDEUVD-2018-19720 No score

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Record
EUVD-2018-19720
Updated
2026-11-03
GitHub AdvisoriesGHSA-w5fc-h82j-vq6w 7.4

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not...

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Record
GHSA-w5fc-h82j-vq6w
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV 7.4

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Record
CVE-2018-8019
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-8019 7.4

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Record
DEBIAN-CVE-2018-8019
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2018:2469 7.1

Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 4 security and bug fix update

Record
RHSA-2018:2469
CVSS 3.0
7.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-8019 7.4

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Record
UBUNTU-CVE-2018-8019
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2019-0184 No score

Updated tomcat-native packages fix security vulnerability

When using an OCSP responder did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS (CVE-2018-8019).

Did not properly check OCSP pre-produced responses. Revoked client certificates may have not been properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS (CVE-2018-8020).

Record
MGASA-2019-0184
Updated
2026-11-02
OSVSUSE-SU-2019:14014-1 No score

Security update for libtcnative-1-0

This update for libtcnative-1-0 to version 1.1.34 fixes the following issues:

  • CVE-2017-15698: Fixed an improper handling of fields with more than 127 bytes which could allow invalid client certificates to be accepted (bsc#1078679).
  • CVE-2018-8019: When using an OCSP responder did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS (bsc#1103348).
  • CVE-2018-8020: Did not properly check OCSP pre-produced responses. Revoked client certificates may have not been properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS (bsc#1103347).

For a complete list of changes please see http://tomcat.apache.org/native-1.1-doc/miscellaneous/changelog.html

Record
SUSE-SU-2019:14014-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tomcat-native
Debian:12
 before 1.2.17-1
1.2.17-1
tomcat-native
Debian:13
 before 1.2.17-1
1.2.17-1
tomcat-native
Debian:14
 before 1.2.17-1
1.2.17-1
tomcat-native
Debian:8
 before 1.1.32~repack-2+deb8u2, plus listed versions
1.1.32~repack-21.1.32~repack-2+deb8u1
1.1.32~repack-2+deb8u2
tomcat-native
Mageia:6
 before 1.2.18-1.mga6
1.2.18-1.mga6
tomcat-native
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:1.2.17-17.redhat_17.ep7.el6
0:1.2.17-17.redhat_17.ep7.el6
tomcat-native-debuginfo
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:1.2.17-17.redhat_17.ep7.el6
0:1.2.17-17.redhat_17.ep7.el6
tomcat7
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
Show 50 moreShow less
Affected packages
PackageAffectedFixed
tomcat7-el-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-jsvc
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-lib
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-selinux
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:7.0.70-27.ep7.el6
0:7.0.70-27.ep7.el6
tomcat8
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-admin-webapps
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-docs-webapp
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-el-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-javadoc
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-jsvc
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-lib
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-log4j
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-selinux
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-servlet-3.1-api
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat8-webapps
Red Hat:jboss_enterprise_web_server:3.1::el6
 before 0:8.0.36-31.ep7.el6
0:8.0.36-31.ep7.el6
tomcat-native
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:1.2.17-17.redhat_17.ep7.el7
0:1.2.17-17.redhat_17.ep7.el7
tomcat-native-debuginfo
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:1.2.17-17.redhat_17.ep7.el7
0:1.2.17-17.redhat_17.ep7.el7
tomcat7
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-el-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-jsvc
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-lib
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-selinux
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:7.0.70-27.ep7.el7
0:7.0.70-27.ep7.el7
tomcat8
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-admin-webapps
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-docs-webapp
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-el-2.2-api
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-javadoc
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-jsvc
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-lib
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-log4j
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-selinux
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-servlet-3.1-api
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
tomcat8-webapps
Red Hat:jboss_enterprise_web_server:3.1::el7
 before 0:8.0.36-31.ep7.el7
0:8.0.36-31.ep7.el7
libtcnative-1-0
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 1.3.4-12.5.5.2
1.3.4-12.5.5.2
libtcnative-1-0
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.3.4-12.5.5.2
1.3.4-12.5.5.2
tomcat-native
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.33-1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-8019 is a high vulnerability (CVSS 7.4) in Apache Tomcat Native, published July 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.05%, the 90th percentile. Fixed in tomcat-native 1.2.17-1.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open