Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2018-8034GHSA-46J3-R4PJ-4835

The host name verification when using TLS with the WebSocket client was missing.

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 9.0.10, 8.5.32, 8.0.53, 7.0.90
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated
  4. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Apache Software Foundation Apache Tomcat

    9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.35 to 7.0.88

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 9.0.0 · fixed in 9.0.10

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 8.5.0 · fixed in 8.5.32

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 8.0.0 · fixed in 8.0.53

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 7.0.35 · fixed in 7.0.90

References 25

usn.ubuntu.com

mail-archives.us.apache.org

access.redhat.com

lists.debian.org

debian.org

securitytracker.com

security.netapp.com

oracle.com

securityfocus.com

lists.apache.org