Lucene search

ApacheCVE-2017-15698

HistoryJan 31, 2018 - 2:29 p.m.

CVE-2017-15698

2018-01-3114:29:00

CWE-295

apache

web.nvd.nist.gov

cve-2017-15698

apache tomcat

aia-extension

client certificate

ocsp check

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.9

Confidence

High

EPSS

0.003

Percentile

69.6%

JSON

When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.

Affected configurations

Nvd

Vulners

Node

apachetomcat_nativeRange1.1.23–1.1.34

apachetomcat_nativeRange1.2.0–1.2.14

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

VendorProductVersionCPE
apachetomcat_native*cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	tomcat_native	*	cpe:2.3:a:apache:tomcat_native::::::::
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*

CNA Affected

[
  {
    "product": "Apache Tomcat Native",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "1.2.0 to 1.2.14"
      },
      {
        "status": "affected",
        "version": "1.1.23 to 1.1.34"
      }
    ]
  }
]