CVE-2018-8034
CVE-2018-8034
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
CVSS 7.5 · High · EPSS 21.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache tomcat
- Versions
- 9.0.0.M1 to 9.0.9: Affected
- 8.5.0 to 8.5.31: Affected
- 8.0.0.RC1 to 8.0.52: Affected
- 7.0.35 to 7.0.88: Affected
No fix published
tomcat7 Ubuntu:14.04:LTS
- Versions
- 7.0.42-1
- 7.0.47-1
- 7.0.50-1
- 7.0.52-1
- 7.0.52-1ubuntu0.1
- 7.0.52-1ubuntu0.3
- 7.0.52-1ubuntu0.6
- 7.0.52-1ubuntu0.7
- 7.0.52-1ubuntu0.8
- 7.0.52-1ubuntu0.9
- 7.0.52-1ubuntu0.10
- 7.0.52-1ubuntu0.11
- 7.0.52-1ubuntu0.13
- 7.0.52-1ubuntu0.14
- Affected ranges
- ECOSYSTEM: < 7.0.52-1ubuntu0.15
Update to 7.0.52-1ubuntu0.15
tomcat8 Ubuntu:16.04:LTS
- Versions
- 8.0.26-1
- 8.0.28-1
- 8.0.30-1
- 8.0.32-1
- 8.0.32-1ubuntu1
- 8.0.32-1ubuntu1.1
- 8.0.32-1ubuntu1.2
- 8.0.32-1ubuntu1.3
- 8.0.32-1ubuntu1.4
- 8.0.32-1ubuntu1.5
- 8.0.32-1ubuntu1.6
- Affected ranges
- ECOSYSTEM: < 8.0.32-1ubuntu1.7
Update to 8.0.32-1ubuntu1.7
tomcat7 Ubuntu:Pro:16.04:LTS
- Versions
- 7.0.64-1
- 7.0.68-1
- 7.0.68-1ubuntu0.1
- 7.0.68-1ubuntu0.3
- 7.0.68-1ubuntu0.4
- 7.0.68-1ubuntu0.4+esm1
- 7.0.68-1ubuntu0.4+esm2
- 7.0.68-1ubuntu0.4+esm3
- 7.0.68-1ubuntu0.4+esm4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:18.04:LTS
- Versions
- 8.5.21-1ubuntu1
- 8.5.29-1
- 8.5.30-1
- 8.5.30-1ubuntu1
- 8.5.30-1ubuntu1.2
- 8.5.30-1ubuntu1.3
- 8.5.30-1ubuntu1.4
- Affected ranges
- ECOSYSTEM: < 8.5.39-1ubuntu1~18.04.1
Update to 8.5.39-1ubuntu1~18.04.1
Original sources
- https://usn.ubuntu.com/3723-1/
- http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:0451
- https://lists.debian.org/debian-lts-announce/2018/07/msg00047.html
- https://www.debian.org/security/2018/dsa-4281
- http://www.securitytracker.com/id/1041374
- https://security.netapp.com/advisory/ntap-20180817-0001/
- https://access.redhat.com/errata/RHSA-2019:0131
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://access.redhat.com/errata/RHSA-2019:0130
- https://access.redhat.com/errata/RHSA-2019:0450
- https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html
- http://www.securityfocus.com/bid/104895
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2018-8034