CVE-2018-8019 Auth bypass in Apache Tomcat Native
Attackers can authenticate using revoked client certificates when OCSP is enabled, bypassing mutual TLS security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-8019?
CVE-2018-8019 is a high-severity authentication bypass vulnerability in Debian Debian Linux, published on 31 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.
Weakness: CWE-295
Which versions are affected by CVE-2018-8019?
It affects 2 products.
Products include Apache Tomcat Native, Debian Debian Linux.
How do I fix CVE-2018-8019?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-8019 being exploited?
There is no known exploitation of CVE-2018-8019 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2026-86246 Apache Tomcat Native: Insecure OpenSSL options enabled
- CVE-2026-86243 Apache Tomcat Native: DoS via TLS handshake
- CVE-2026-86247 Apache Tomcat Native: Client certificate requirements can be down-graded
- CVE-2018-8020 Auth bypass in Apache Tomcat Native
- CVE-2017-15698 Security feature bypass in Apache Tomcat Native
Sources
Also known as DEBIAN-CVE-2018-8019, GHSA-w5fc-h82j-vq6w, UBUNTU-CVE-2018-8019.