tomcat: Host name verification missing in WebSocket client

🗓️ 14 Nov 2019 21:17:38Reported by RedHatType

Tomcat enables host name verification by default for TLS WebSocket client; affects multiple versions.

Reporter	Title	Published	Views	Family All 180
IBM Security Bulletins	Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerabilities (CVE-2018-11784, CVE-2018-8034)	4 Feb 201913:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Fasterxml Jackson,FasterXML Jackson Core,Bouncy Castle Java, Netty,Hibernate Validator,JCraft JSch,Apache Tomcat,Bootstrap might affect IBM Storage Defender Copy Data Management	12 Dec 202515:28	–	ibm
IBM Security Bulletins	Security Bulletin: Rational DOORS Web Access is affected by Apache Tomcat vulnerabilities	23 Oct 201817:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache Tomcat, Open SSL, and Apache HTTPD affects Rational Build Forge	21 Nov 201822:55	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to publicly disclosed vulnerability. (CVE-2018-8034, CVE-2018-8037)	3 Dec 201814:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus affected by Apache Tomcat vulnerability CVE-2018-8034	23 Mar 202020:41	–	ibm
Tenable Nessus	Apache Tomcat 7.0.41 < 7.0.90 Security Bypass	13 May 201900:00	–	nessus
Tenable Nessus	Amazon Linux 2 : tomcat (ALAS-2020-1402)	16 Mar 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : tomcat7 / tomcat80 (ALAS-2018-1055)	10 Aug 201800:00	–	nessus
Tenable Nessus	Amazon Linux AMI : tomcat8 (ALAS-2018-1056)	10 Aug 201800:00	–	nessus

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2018-8034
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-8034
cve	www.cve.org/CVERecord

01 Jul 2026 19:20Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 37.5

CVSS 3.17.5

EPSS0.213

SSVC