Skip to content
fr Sign in
Not rated

CVE-2017-15698 When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and…

Description

When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.

Affected products and versions

Product Affected versions Fixed in
Apache Tomcat Native Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Tomcat Native

The 8 CVEs of Apache Tomcat Native →
CVE-2026-86247 Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification… Not rated CVE-2026-86246 Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure… Not rated CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a… Not rated CVE-2026-29145 CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in… Not rated
Track this CVE