CVE-2018-8034

Published: Aug 1, 2018Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

Affected (48)

Products: Apache: Tomcat · Canonical: Ubuntu Linux · Debian: Debian Linux · +1 more

Show all products

Apache: Tomcat · Canonical: Ubuntu Linux · Debian: Debian Linux · Oracle: Retail Order Broker

1 product

1 product

1 product

1 product

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 7.0.35 to 7.0.88
Apache Tomcat	From 8.0.0 to 8.0.52
Apache Tomcat	From 8.5.0 to 8.5.31
Apache Tomcat	From 9.0.1 to 9.0.9
Apache Tomcat	Version 8.0.0 rc10
Apache Tomcat	Version 8.0.0 rc1
Apache Tomcat	Version 8.0.0 rc2
Apache Tomcat	Version 8.0.0 rc3
Apache Tomcat	Version 8.0.0 rc4
Apache Tomcat	Version 8.0.0 rc5
Apache Tomcat	Version 8.0.0 rc6
Apache Tomcat	Version 8.0.0 rc7
Apache Tomcat	Version 8.0.0 rc8
Apache Tomcat	Version 8.0.0 rc9
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone1
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone22
Apache Tomcat	Version 9.0.0 milestone23
Apache Tomcat	Version 9.0.0 milestone24
Apache Tomcat	Version 9.0.0 milestone25
Apache Tomcat	Version 9.0.0 milestone26
Apache Tomcat	Version 9.0.0 milestone27
Apache Tomcat	Version 9.0.0 milestone2
Apache Tomcat	Version 9.0.0 milestone3
Apache Tomcat	Version 9.0.0 milestone4
Apache Tomcat	Version 9.0.0 milestone5
Apache Tomcat	Version 9.0.0 milestone6
Apache Tomcat	Version 9.0.0 milestone7
Apache Tomcat	Version 9.0.0 milestone8
Apache Tomcat	Version 9.0.0 milestone9

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Retail Order Broker	Version 15.0
Oracle Retail Order Broker	Version 5.1
Oracle Retail Order Broker	Version 5.2

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (82)

http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E

Source: security@apache.org

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: security@apache.org

PatchThird Party Advisory

http://www.securityfocus.com/bid/104895

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1041374

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:0130

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0131

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0450

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0451

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1159

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2019:1160

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2019:1161

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2019:1162

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2019:1529

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2019:2205

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2019:3892

Source: security@apache.org

https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2018/07/msg00047.html

Source: security@apache.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20180817-0001/

Source: security@apache.org

Third Party Advisory

https://usn.ubuntu.com/3723-1/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4281

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: security@apache.org

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: security@apache.org

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: security@apache.org

http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E