CVE-2018-8034: High severity Apache Tomcat vulnerability
Flaw affecting tomcat 8.0.0.RC1 to 8.0.52 and 9.0.0.M1 to 9.0.9 . The host name verification when using TLS with the WebSocket client was not enabled by default.
Upstream patch:
http://svn.apache.org/viewvc?view=revision&revision=1833757 http://svn.apache.org/viewvc?view=rev&rev=1833759
References:
https://tomcat.apache.org/security-8.html https://tomcat.apache.org/security-9.html
Other sources
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 7.0.90 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.0.53 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.5.32 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 9.0.10 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.43-2~deb11u10Fixed in 9.0.107-0+deb11u2Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.115-1 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.53 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.32 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 9.0.10 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.90 - Compensating control
For Apache Tomcat WebSocket over TLS, enable host name verification for TLS connections made by the WebSocket client (the issue was that host name verification was missing / not enabled by default).
Event History
Frequently Asked Questions
What is the severity of CVE-2018-8034?
CVE-2018-8034 is considered a moderate severity vulnerability due to insufficient hostname verification in TLS connections.
How do I fix CVE-2018-8034?
To fix CVE-2018-8034, upgrade your Tomcat installation to version 8.0.53, 8.5.32, or 9.0.10 or later.
Which versions of Tomcat are affected by CVE-2018-8034?
CVE-2018-8034 affects Tomcat versions 8.0.0.RC1 to 8.0.52 and 9.0.0.M1 to 9.0.9.
What kind of attack can CVE-2018-8034 enable?
CVE-2018-8034 could allow an attacker to perform man-in-the-middle attacks if hostname verification is bypassed.
Is CVE-2018-8034 present in embedded versions of Tomcat?
Yes, CVE-2018-8034 is present in embedded versions of Tomcat that fall within the affected version ranges.