Non notée
CVE-2017-15698 When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and…
Description
When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Tomcat Native | Versions non publiées |
Références
- DSA-4118 www.debian.org
- [debian-lts-announce] 20180211 [SECURITY] [DLA 1276-1] tomcat-native security update lists.debian.org
- RHSA-2018:0465 access.redhat.com
- 1040390 www.securitytracker.com
- [announce] 20180131 [SECURITY] CVE-2017-15698 Apache Tomcat Native Connector - OCSP check omitted lists.apache.org
- RHSA-2018:0466 access.redhat.com
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/ lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Tomcat Native
Les 8 CVE de Apache Tomcat Native →
CVE-2026-86247
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification…
Non notée
CVE-2026-86246
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure…
Non notée
CVE-2026-86243
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a…
Non notée
CVE-2026-29145
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in…
Non notée