CVE-2018-1336 In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder
An attacker can cause a denial of service in Apache Tomcat by sending specially crafted UTF-8 supplementary characters that trigger an infinite loop in the decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1336?
CVE-2018-1336 is a high-severity denial of service vulnerability in Apache Tomcat, published on 2 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
Weakness: CWE-835
Which versions are affected by CVE-2018-1336?
8 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.28 | 7.0.87 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.28 | 7.0.87 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0RC1 | 8.0.51 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0RC1 | 8.0.51 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.31 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.31 |
2 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0.M9 | 9.0.8 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0.M9 | 9.0.8 |
Linux distribution packages (32)
tomcat Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-admin-webapps Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-docs-webapp Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-el-2.2-api Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-javadoc Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-jsp-2.2-api Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-jsvc Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-lib Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-servlet-3.0-api Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat-webapps Red Hat:enterprise_linux:7::client | All versions | 0:7.0.76-8.el7_5 |
tomcat Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-admin-webapps Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-docs-webapp Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-el-2.2-api Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-jsp-2.2-api Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-jsvc Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-lib Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-servlet-3.0-api Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat-webapps Red Hat:enterprise_linux:7::computenode | All versions | 0:7.0.76-8.el7_5 |
tomcat Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-admin-webapps Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-docs-webapp Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-el-2.2-api Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-javadoc Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-jsp-2.2-api Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-jsvc Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-lib Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-servlet-3.0-api Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat-webapps Red Hat:enterprise_linux:7::server | All versions | 0:7.0.76-8.el7_5 |
tomcat Red Hat:enterprise_linux:7::workstation | All versions | 0:7.0.76-8.el7_5 |
tomcat-admin-webapps Red Hat:enterprise_linux:7::workstation | All versions | 0:7.0.76-8.el7_5 |
Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation and 2 more.
How do I fix CVE-2018-1336?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 7.0.87, 8.0.51, 8.5.31 or 9.0.8.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-1336 being exploited?
There is no known exploitation of CVE-2018-1336 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as GHSA-m59c-jpc8-m2x4, RHEA-2018:2188, RHEA-2018:2189, RHSA-2018:2701, RHSA-2018:2921, UBUNTU-CVE-2018-1336.