Improper Input Validation in Apache Tomcat Native OCSP Handling

Executive Summary

This vulnerability is an Improper Input Validation issue in Apache Tomcat Native and Apache Tomcat when using an OCSP responder. Specifically, Tomcat Native and Tomcat's FFM port of the Tomcat Native code did not complete verification or freshness checks on the OCSP response. This flaw could allow an attacker to bypass certificate revocation checks.

Useful 0 Not Useful 0

Impact Analysis

Because the verification or freshness checks on OCSP responses are not properly completed, an attacker could bypass certificate revocation. This means that revoked certificates might still be accepted as valid, potentially allowing unauthorized or malicious entities to impersonate trusted parties or intercept secure communications.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade affected Apache Tomcat Native versions to 1.3.5 or later or 2.0.12 or later.

For Apache Tomcat, upgrade to versions 11.0.18 or later, 10.1.52 or later, or 9.0.115 or later.

Useful 0 Not Useful 0