CVE-2017-15698 Security feature bypass in Apache Tomcat Native
Attackers can bypass OCSP revocation checks in Apache Tomcat Native Connector by using long AIA fields, allowing revoked client certificates to be accepted.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15698?
CVE-2017-15698 is a medium-severity vulnerability in Debian Debian Linux, published on 31 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.
Weakness: CWE-295
Which versions are affected by CVE-2017-15698?
It affects 2 products.
Products include Apache Tomcat Native, Debian Debian Linux.
How do I fix CVE-2017-15698?
Apply the vendor's patch.
Is CVE-2017-15698 being exploited?
There is no known exploitation of CVE-2017-15698 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2026-86246 Apache Tomcat Native: Insecure OpenSSL options enabled
- CVE-2026-86243 Apache Tomcat Native: DoS via TLS handshake
- CVE-2026-86247 Apache Tomcat Native: Client certificate requirements can be down-graded
- CVE-2018-8019 Auth bypass in Apache Tomcat Native
- CVE-2018-8020 Auth bypass in Apache Tomcat Native
Sources
Also known as DEBIAN-CVE-2017-15698, DLA-1276-1, DSA-4118-1, GHSA-ppg5-72hh-9jj4, MGASA-2018-0150, UBUNTU-CVE-2017-15698.