Bug 1581569 (CVE-2018-8020)
| Summary: | CVE-2018-8020 tomcat-native: Mishandled OCSP responses can allow clients to authenticate with revoked certificates | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | bmaxwell, cdewolf, chazlett, csutherl, darran.lofthouse, dimitris, dosoudil, fgavrilo, gzaronik, jawilson, jclere, jdoyle, jondruse, ksuzumur, lgao, lorenzo.dalrio, mbabacek, mczernek, myarboro, pgier, pjurak, ppalaga, psakar, pslavice, rnetuka, rstancel, rsvoboda, security-response-team, sstavrev, twalsh, vtunka, weli, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | tomcat-native 1.2.17 | Doc Type: | If docs needed, set a value |
| Doc Text: |
When using pre-produced responses from an OCSP responder, Tomcat Native did not correctly validate the status of certificates. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:26:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1585841, 1585842, 1610613, 1610614 | ||
| Bug Blocks: | 1579038 | ||
|
Description
Sam Fowler
2018-05-23 06:16:44 UTC
Acknowledgments: Name: Coty Sutherland (Red Hat) External References: http://mail-archives.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180721095943.GA24320%40minotaur.apache.org%3E http://tomcat.apache.org/security-native.html#Fixed_in_Apache_Tomcat_Native_Connector_1.2.17 Upstream Patch: http://svn.apache.org/viewvc?view=revision&revision=1832863 Created tomcat-native tracking bugs for this issue: Affects: epel-all [bug 1610614] Affects: fedora-all [bug 1610613] This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2018:2470 https://access.redhat.com/errata/RHSA-2018:2470 This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 7 Red Hat JBoss Web Server 3 for RHEL 6 Via RHSA-2018:2469 https://access.redhat.com/errata/RHSA-2018:2469 |