Name: CVE-2018-8034: Improper Certificate Validation
Creator: Rapid7
Published: 2018-08-01T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-8034, CWE-295, CVSS 7.5, EPSS 0.20786

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade slf4jUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade velocityUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade jakarta-commons-httpclient	May 13, 2022	Aug 1, 2018
Amazon Linux Ami 2	—	Upgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-javadoc	Apr 27, 2020	Aug 1, 2018
Amazon_linux	—	Upgrade tomcat7Upgrade tomcat8Upgrade tomcat80	Aug 11, 2018	Aug 1, 2018
Apache Tomcat	—	Upgrade Apache Tomcat to 9.0.10Upgrade Apache Tomcat to 7.0.90Upgrade Apache Tomcat to 8.0.53Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 8.5.32	Aug 1, 2018	Aug 1, 2018
Centos_linux	—	Upgrade xerces-j2Upgrade tomcat-admin-webappsUpgrade xmlstreambufferUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade tomcat-servlet-3.0-apiUpgrade javassistUpgrade glassfish-jaxb-runtimeUpgrade tomcatUpgrade tomcat-webappsUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade python-nss-docUpgrade tomcat-docs-webappUpgrade javassist-javadocUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade tomcat-libUpgrade jackson-annotationsUpgrade jackson-jaxrs-providersUpgrade tomcat-javadocUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade slf4jUpgrade python-nss-debugsourceUpgrade stax-exUpgrade resteasyUpgrade xsomUpgrade pki-servlet-containerUpgrade jackson-coreUpgrade apache-commons-langUpgrade python3-nss-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade velocity	Aug 28, 2019	Aug 1, 2018
Debian	—	Upgrade tomcat8Upgrade tomcat9Upgrade tomcat7	Aug 30, 2018	Aug 1, 2018
Huawei Euleros 2_0_sp2	—	Upgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-api	Dec 4, 2019	Aug 1, 2018
Huawei Euleros 2_0_sp3	—	Upgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-admin-webapps	Dec 18, 2019	Aug 1, 2018
Huawei Euleros 2_0_sp5	—	Upgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-api	Sep 24, 2019	Aug 1, 2018
Oracle Solaris	—	Upgrade library/perl-5/net-ssleay to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/wireshark-common to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-526 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/embedded to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/liblouis to version 3.5.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-522 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-522 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/dotconf to version 1.3-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57 to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-526 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-526 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-526 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade library/perl-5/xml-namespacesupport to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/speech-dispatcher to version 0.8.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/speech/espeak to version 1.44.0.5-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-526 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-526 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/webkitgtk4 to version 2.18.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam to version 5.8.4-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-522 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-522 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/tshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-526 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-34 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-526 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-522 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-522 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser to version 5.12.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3/documentation to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-526 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-522 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/client to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/curl to version 7.61.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-522 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/tests to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-522 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-522 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/library to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/desktop-startup to version 0.38.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade mail/mailman to version 2.1.29.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-526 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-522 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-526 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-526 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-526 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-27 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade library/python/pyatspi2-35 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade image/library/libjpeg to version 6.0.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-526 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-522 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/gdm to version 3.24.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-526 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-522 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-522 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-522 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-526 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-522 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-526 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-522 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4	Aug 24, 2018	Aug 1, 2018
Oracle_linux	—	Upgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade slf4jUpgrade apache-commons-langUpgrade jackson-jaxrs-json-providerUpgrade relaxngDatatypeUpgrade tomcat-javadocUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade bea-stax-apiUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade javassist-javadocUpgrade resteasyUpgrade tomcat-servlet-3.0-apiUpgrade pki-servlet-containerUpgrade jackson-databindUpgrade tomcat-docs-webappUpgrade xml-commons-resolverUpgrade tomcat-admin-webappsUpgrade xml-commons-apisUpgrade tomcat-el-2.2-apiUpgrade xmlstreambufferUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade xsomUpgrade apache-commons-collectionsUpgrade pki-servlet-4.0-apiUpgrade velocityUpgrade tomcat-webappsUpgrade python3-nssUpgrade javassistUpgrade stax-exUpgrade tomcat-libUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade tomcat-jsvc	Aug 15, 2019	Jul 22, 2018
Red Hat Jboss Eap	—	Upgrade Red Hat JBoss EAP to the latest version	Sep 19, 2024	Jul 22, 2018
Redhat_linux	—	Upgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade tomcat-docs-webappUpgrade python-nss-docUpgrade javassist-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade velocityUpgrade tomcat-javadocUpgrade tomcat-libUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-providersUpgrade pki-servlet-containerUpgrade resteasyUpgrade xerces-j2Upgrade stax-exUpgrade jackson-databindUpgrade xmlstreambufferUpgrade python-nss-debugsourceUpgrade slf4jUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade tomcat-jsvcUpgrade apache-commons-langUpgrade tomcatUpgrade glassfish-fastinfosetUpgrade python3-nss-debuginfo	Jun 19, 2019	Aug 1, 2018
Rocky_linux	—	Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-doc	Mar 12, 2024	Aug 1, 2018
Suse	—	Upgrade tomcat-embedUpgrade tomcat-el-2_2-apiUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-libUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-api	Sep 13, 2018	Aug 1, 2018
Ubuntu	—	Upgrade libtomcat7-javaUpgrade libtomcat8-javaUpgrade tomcat8Upgrade tomcat7	Aug 4, 2018	Jul 25, 2018
Vmware Photon_os	—	Use 'tdnf update' to upgrade all packages to the latest version.	Jan 20, 2025	Aug 1, 2018

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence