CVE-2018-8034: Apache Tomcat Host Name Verification Missing
Summary
CVE-2018-8034: The host name verification missing in Apache Tomcat. Affects org.apache.tomcat.embed:tomcat-embed-core across 4 version ranges.
>= 7.0.35, < 7.0.90
>= 8.0.0, < 8.0.53
>= 8.5.0, < 8.5.32
>= 9.0.0, < 9.0.10
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The Apache Tomcat Embed Core package is a Maven package that allows embedding Tomcat into other applications. This package is vulnerable to a host name verification issue when using TLS with the WebSocket client.
Vulnerability Detail
The host name verification was missing in Apache Tomcat when using TLS with the WebSocket client. This means that an attacker could potentially perform a man-in-the-middle attack by presenting a valid certificate for one host, but connecting to a different host. This could lead to sensitive information leakage or unauthorized access to the application. The vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.35, < 7.0.907.0.90 -
>= 8.0.0, < 8.0.538.0.53 -
>= 8.5.0, < 8.5.328.5.32 -
>= 9.0.0, < 9.0.109.0.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround is to manually enable host name verification in the WebSocket client configuration. This can be done by setting the 'org.apache.tomcat.websocket.TLS_HOSTNAME_VERIFIER' system property to 'org.apache.tomcat.websocket.TomcatWebSocketHostnameVerifier'. This ensures that the host name is properly verified during TLS handshake.
Conclusion
The missing host name verification vulnerability in Apache Tomcat can be fixed by upgrading to the latest version or applying the provided workaround. It is important to promptly address this vulnerability to prevent potential security breaches. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
The vulnerability allows an attacker to perform a man-in-the-middle attack, potentially leading to sensitive information leakage or unauthorized access to the application.
The vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
To fix this vulnerability, it is recommended to upgrade to the latest version of Apache Tomcat. See the 'how_to_fix' section for specific version recommendations.
Yes, a workaround is to manually enable host name verification in the WebSocket client configuration. See the 'workaround' section for more details.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
