Fixed in Apache Tomcat Native Connector 1.2.16

Note: The issue below was fixed in Apache Tomcat Native Connector 1.2.15 but the release vote for the 1.2.15 release candidate did not pass. Therefore, although users must download 1.2.16 to obtain a version that includes the fix for this issue, version 1.2.15 is not included in the list of affected versions.

Moderate: OCSP check omitted CVE-2017-15698

When parsing the AIA-Extension field of a client certificate, the Apache Tomcat Native Connector did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.

This was fixed in revisions 1815200 and 1815218.

This issue was reported to the Apache Tomcat Security Team by Jonas Klempel on 6 November 2017 and made public on 31 January 2018.

Affects: 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34