Description
When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat Native | 1.2.0 to 1.2.14, 1.1.23 to 1.1.34 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tomcat-native | 1.2.16-1 | — |
| Debian 13 | tomcat-native | 1.2.16-1 | — |
| Debian 12 | tomcat-native | 1.2.16-1 | — |
| Debian 9 | tomcat-native | 1.2.12-2+deb9u1 | DSA-4118-1 |
| Debian 8 | tomcat-native | 1.1.32~repack-2+deb8u1 | DSA-4118-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | tomcat-native | 1.1.24-1+deb7u1 | DLA-1276-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | tomcat-native | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | mod_cluster +2 | 1.3.8-2.Final_redhat_2.1.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-11.redhat_11.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Web Server 3 | tomcat-vault +2 | 1.1.6-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-25.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-29.ep7.el6 | RHSA-2018:0466 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | libtcnative-1-0 | 1.3.4-12.5.5.2 | SUSE-SU-2019:14014-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Linux Enterprise Point of Sale 11 SP3 | libtcnative-1-0 | 1.3.4-12.5.5.2 | SUSE-SU-2019:14014-1 |
Advisories 4
- RHSA-2018:0466 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- DSA-4118-1 tomcat-native - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1276-1 tomcat-native - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:14014-1 Security update for libtcnative-1-0 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-4118 vendor-advisory
- [debian-lts-announce] 20180211 [SECURITY] [DLA 1276-1] tomcat-native security update mailing-list
- RHSA-2018:0465 vendor-advisory
- 1040390 vdb-entry
- [announce] 20180131 [SECURITY] CVE-2017-15698 Apache Tomcat Native Connector - OCSP check omitted mailing-list
- RHSA-2018:0466 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/ mailing-list