CVE-2018-8020 Auth bypass in Apache Tomcat Native
Attackers can authenticate using revoked client certificates in mutual TLS setups due to improper OCSP response validation in Apache Tomcat Native.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-8020?
CVE-2018-8020 is a high-severity authentication bypass vulnerability in Debian Debian Linux, published on 31 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.
Weakness: CWE-295
Which versions are affected by CVE-2018-8020?
It affects 2 products.
Products include Apache Tomcat Native, Debian Debian Linux.
How do I fix CVE-2018-8020?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-8020 being exploited?
There is no known exploitation of CVE-2018-8020 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2026-86246 Apache Tomcat Native: Insecure OpenSSL options enabled
- CVE-2026-86243 Apache Tomcat Native: DoS via TLS handshake
- CVE-2026-86247 Apache Tomcat Native: Client certificate requirements can be down-graded
- CVE-2018-8019 Auth bypass in Apache Tomcat Native
- CVE-2017-15698 Security feature bypass in Apache Tomcat Native
Sources
Also known as DEBIAN-CVE-2018-8020, GHSA-r94v-7v68-9rjq, UBUNTU-CVE-2018-8020.