CVE-2018-8034

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 21.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-01 · updated 2026-06-17
Weakness: CWE-295

Description

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

Affected products

Apache Tomcat: from 7.0.35 through 7.0.88; from 8.0.0 through 8.0.52; from 8.5.0 through 8.5.31; from 9.0.1 through 9.0.9; 8.0.0-rc1, 8.0.0-rc10, 8.0.0-rc2, 8.0.0-rc3, 8.0.0-rc4, 8.0.0-rc5 (+31)
Canonical Ubuntu Linux: 14.04, 16.04
Debian Linux: 8.0, 9.0
Oracle Retail Order Broker: 5.1, 5.2, 15.0

References

http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/104895
http://www.securitytracker.com/id/1041374
https://access.redhat.com/errata/RHSA-2019:0130
https://access.redhat.com/errata/RHSA-2019:0131
https://access.redhat.com/errata/RHSA-2019:0450
https://access.redhat.com/errata/RHSA-2019:0451
https://access.redhat.com/errata/RHSA-2019:1159
https://access.redhat.com/errata/RHSA-2019:1160
https://access.redhat.com/errata/RHSA-2019:1161
https://access.redhat.com/errata/RHSA-2019:1162

Get alerted when CVE-2018-8034 or the next vulnerability affects your stack