CVE-2018-1336
First published: Mon Jul 23 2018(Updated: )
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.tomcat.embed:tomcat-embed-core | >=8.0.0RC1<8.0.51 | 8.0.51 |
| maven/org.apache.tomcat.embed:tomcat-embed-core | >=9.0.0.M9<=9.0.7 | 9.0.8 |
| maven/org.apache.tomcat.embed:tomcat-embed-core | >=7.0.28<7.0.87 | 7.0.87 |
| maven/org.apache.tomcat.embed:tomcat-embed-core | >=8.5.0<8.5.31 | 8.5.31 |
| redhat/tomcat | <8.0.52 | 8.0.52 |
| redhat/tomcat | <8.5.31 | 8.5.31 |
| redhat/tomcat | <9.0.8 | 9.0.8 |
| redhat/tomcat | <7.0.88 | 7.0.88 |
| debian/tomcat9 | 9.0.43-2~deb11u10 9.0.43-2~deb11u11 9.0.70-2 9.0.95-1 | |
| Tomcat | >=7.0.28<=7.0.86 | |
| Tomcat | >=8.0.0<=8.0.51 | |
| Tomcat | >=8.5.0<=8.5.30 | |
| Tomcat | >=9.0.1<=9.0.7 | |
| Tomcat | =8.0.0-rc1 | |
| Tomcat | =8.0.0-rc10 | |
| Tomcat | =8.0.0-rc2 | |
| Tomcat | =8.0.0-rc3 | |
| Tomcat | =8.0.0-rc4 | |
| Tomcat | =8.0.0-rc5 | |
| Tomcat | =8.0.0-rc6 | |
| Tomcat | =8.0.0-rc7 | |
| Tomcat | =8.0.0-rc8 | |
| Tomcat | =8.0.0-rc9 | |
| Tomcat | =9.0.0-milestone10 | |
| Tomcat | =9.0.0-milestone11 | |
| Tomcat | =9.0.0-milestone12 | |
| Tomcat | =9.0.0-milestone13 | |
| Tomcat | =9.0.0-milestone14 | |
| Tomcat | =9.0.0-milestone15 | |
| Tomcat | =9.0.0-milestone16 | |
| Tomcat | =9.0.0-milestone17 | |
| Tomcat | =9.0.0-milestone18 | |
| Tomcat | =9.0.0-milestone19 | |
| Tomcat | =9.0.0-milestone20 | |
| Tomcat | =9.0.0-milestone21 | |
| Tomcat | =9.0.0-milestone22 | |
| Tomcat | =9.0.0-milestone23 | |
| Tomcat | =9.0.0-milestone24 | |
| Tomcat | =9.0.0-milestone25 | |
| Tomcat | =9.0.0-milestone26 | |
| Tomcat | =9.0.0-milestone27 | |
| Tomcat | =9.0.0-milestone9 | |
| JBoss Enterprise Application Platform | =6.0.0 | |
| JBoss Enterprise Application Platform | =6.4.0 | |
| Ubuntu | =14.04 | |
| Ubuntu | =16.04 | |
| Debian | =8.0 | |
| Debian | =9.0 | |
| All of | ||
| Red Hat JBoss Enterprise Web Server | =3.0.0 | |
| Any of | ||
| Red Hat Enterprise Linux | =6.0 | |
| Red Hat Enterprise Linux | =7.0 | |
| All of | ||
| Red Hat JBoss Enterprise Web Server | =5.0.0 | |
| Any of | ||
| Red Hat Enterprise Linux | =6.0 | |
| Red Hat Enterprise Linux | =7.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| Tomcat | =9.0.0-m10 | |
| Tomcat | =9.0.0-m11 | |
| Tomcat | =9.0.0-m12 | |
| Tomcat | =9.0.0-m13 | |
| Tomcat | =9.0.0-m14 | |
| Tomcat | =9.0.0-m15 | |
| Tomcat | =9.0.0-m16 | |
| Tomcat | =9.0.0-m17 | |
| Tomcat | =9.0.0-m18 | |
| Tomcat | =9.0.0-m19 | |
| Tomcat | =9.0.0-m20 | |
| Tomcat | =9.0.0-m21 | |
| Tomcat | =9.0.0-m22 | |
| Tomcat | =9.0.0-m23 | |
| Tomcat | =9.0.0-m24 | |
| Tomcat | =9.0.0-m25 | |
| Tomcat | =9.0.0-m26 | |
| Tomcat | =9.0.0-m27 | |
| Tomcat | =9.0.0-m9 | |
| Red Hat JBoss Enterprise Web Server | =3.0.0 | |
| Red Hat Enterprise Linux | =6.0 | |
| Red Hat Enterprise Linux | =7.0 | |
| Red Hat JBoss Enterprise Web Server | =5.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E
- http://www.securityfocus.com/bid/104898
- http://www.securitytracker.com/id/1041375
- https://access.redhat.com/errata/RHEA-2018:2188
- https://access.redhat.com/errata/RHEA-2018:2189
- https://access.redhat.com/errata/RHSA-2018:2700
- https://access.redhat.com/errata/RHSA-2018:2701
- https://access.redhat.com/errata/RHSA-2018:2740
- https://access.redhat.com/errata/RHSA-2018:2741
- https://access.redhat.com/errata/RHSA-2018:2742
- https://access.redhat.com/errata/RHSA-2018:2743
- https://access.redhat.com/errata/RHSA-2018:2921
- https://access.redhat.com/errata/RHSA-2018:2930
- https://access.redhat.com/errata/RHSA-2018:2939
- https://access.redhat.com/errata/RHSA-2018:2945
- https://access.redhat.com/errata/RHSA-2018:3768
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html
- https://security.netapp.com/advisory/ntap-20180817-0001/
- https://support.f5.com/csp/article/K73008537?utm_source=f5support&utm_medium=RSS
- https://usn.ubuntu.com/3723-1/
- https://www.debian.org/security/2018/dsa-4281
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
- https://support.f5.com/csp/article/K73008537?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K73008537?utm_source=f5support&amp;utm_medium=RSS
- https://launchpad.net/bugs/cve/CVE-2018-1336
- https://nvd.nist.gov/vuln/detail/CVE-2018-1336
- https://web.archive.org/web/20190703075545/http://www.securitytracker.com/id/1041375
- https://web.archive.org/web/20200227102810/http://www.securityfocus.com/bid/104898
- https://github.com/apache/tomcat/commit/156d76a6afeef440d14044a560d6ad1d029361c4
- https://github.com/apache/tomcat/commit/92cd494555598e99dd691712e8ee426a2f9c2e93
- https://github.com/apache/tomcat/commit/e00812b94e5830b2be3de04f4ae4ade38a700074
- https://github.com/apache/tomcat80/commit/9e9b7fe1b5732277a26e437f1d32155de6208ef2
- https://security.netapp.com/advisory/ntap-20180817-0001
- https://usn.ubuntu.com/3723-1
- https://github.com/advisories/GHSA-m59c-jpc8-m2x4 (Advisory)
- http://svn.apache.org/viewvc?view=rev&rev=1830375
- http://svn.apache.org/viewvc?view=rev&rev=1830373
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-9.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1624931
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1624929
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1608656
- https://bugzilla.redhat.com/show_bug.cgi?id=1607591
- https://svn.apache.org/r1830373
- https://svn.apache.org/r1830374
- https://svn.apache.org/r1830375
- https://svn.apache.org/r1830376
- https://security-tracker.debian.org/tracker/CVE-2018-1336
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1336
- https://ubuntu.com/security/CVE-2018-1336
Frequently Asked Questions
What is the severity of CVE-2018-1336?
CVE-2018-1336 has a high severity rating due to its potential to cause a Denial of Service through an infinite loop in the UTF-8 decoder.
How do I fix CVE-2018-1336?
To address CVE-2018-1336, upgrade to Apache Tomcat version 8.0.52 and later, 8.5.31 and later, 9.0.8 and later, or 7.0.87 and later depending on your current version.
Which versions of Apache Tomcat are affected by CVE-2018-1336?
CVE-2018-1336 affects Apache Tomcat versions 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
Can CVE-2018-1336 be exploited remotely?
Yes, CVE-2018-1336 can be exploited remotely to trigger a Denial of Service condition.
What applications are impacted by CVE-2018-1336?
CVE-2018-1336 impacts applications running on affected versions of Apache Tomcat when processing UTF-8 encoded data.
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- agent/author
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-m59c-jpc8-m2x4
- alias/CVE-2018-1336
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- collector/github-advisory
- agent/remedy
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- package-manager/maven
- package-manager/redhat
- package-manager/debian
- vendor/apache
- canonical/tomcat
- version/tomcat/7.0.28
- version/tomcat/7.0.86
- version/tomcat/8.0.0
- version/tomcat/8.0.51
- version/tomcat/8.5.0
- version/tomcat/8.5.30
- version/tomcat/9.0.1
- version/tomcat/9.0.7
- version/tomcat/8.0.0-rc1
- version/tomcat/8.0.0-rc10
- version/tomcat/8.0.0-rc2
- version/tomcat/8.0.0-rc3
- version/tomcat/8.0.0-rc4
- version/tomcat/8.0.0-rc5
- version/tomcat/8.0.0-rc6
- version/tomcat/8.0.0-rc7
- version/tomcat/8.0.0-rc8
- version/tomcat/8.0.0-rc9
- version/tomcat/9.0.0-milestone10
- version/tomcat/9.0.0-milestone11
- version/tomcat/9.0.0-milestone12
- version/tomcat/9.0.0-milestone13
- version/tomcat/9.0.0-milestone14
- version/tomcat/9.0.0-milestone15
- version/tomcat/9.0.0-milestone16
- version/tomcat/9.0.0-milestone17
- version/tomcat/9.0.0-milestone18
- version/tomcat/9.0.0-milestone19
- version/tomcat/9.0.0-milestone20
- version/tomcat/9.0.0-milestone21
- version/tomcat/9.0.0-milestone22
- version/tomcat/9.0.0-milestone23
- version/tomcat/9.0.0-milestone24
- version/tomcat/9.0.0-milestone25
- version/tomcat/9.0.0-milestone26
- version/tomcat/9.0.0-milestone27
- version/tomcat/9.0.0-milestone9
- vendor/redhat
- canonical/jboss enterprise application platform
- version/jboss enterprise application platform/6.0.0
- version/jboss enterprise application platform/6.4.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/14.04
- version/ubuntu/16.04
- vendor/debian
- canonical/debian
- version/debian/8.0
- version/debian/9.0
- canonical/red hat jboss enterprise web server
- version/red hat jboss enterprise web server/3.0.0
- canonical/red hat enterprise linux
- version/red hat enterprise linux/6.0
- version/red hat enterprise linux/7.0
- version/red hat jboss enterprise web server/5.0.0
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/7.0
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/7.0
- version/tomcat/9.0.0-m10
- version/tomcat/9.0.0-m11
- version/tomcat/9.0.0-m12
- version/tomcat/9.0.0-m13
- version/tomcat/9.0.0-m14
- version/tomcat/9.0.0-m15
- version/tomcat/9.0.0-m16
- version/tomcat/9.0.0-m17
- version/tomcat/9.0.0-m18
- version/tomcat/9.0.0-m19
- version/tomcat/9.0.0-m20
- version/tomcat/9.0.0-m21
- version/tomcat/9.0.0-m22
- version/tomcat/9.0.0-m23
- version/tomcat/9.0.0-m24
- version/tomcat/9.0.0-m25
- version/tomcat/9.0.0-m26
- version/tomcat/9.0.0-m27
- version/tomcat/9.0.0-m9