CVE-2018-8037
high
CVSS v3
—
CVSS v2
—
VIR risk
8.0
Description
Important: pki-deps:10.6 security update
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2019-1529.html
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2018-8037
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2019:1529
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2018-8037.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| rocky | 8 | fixed | |
| debian | bookworm | fixed | 0 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 0 |
| debian | sid | fixed | 0 |
| debian | trixie | fixed | 0 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >=9.0.0.M9,<9.0.10 | 9.0.10 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >=8.5.5,<8.5.32 | 8.5.32 |
References
- https://www.suse.com/security/cve/CVE-2018-8037.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-8037
- https://github.com/apache/tomcat/commit/4c04369c287233ea2e8e5135f6c31d02e2d76293
- https://github.com/apache/tomcat/commit/ccf2e6bf5205561ad18c2300153e9173ec509d73
- https://github.com/apache/tomcat/commit/ed4b9d791f9470e4c3de691dd0153a9ce431701b
- https://github.com/apache/tomcat/commit/f94eedf02b5973598ab3dbbd4504da588e9ba6cb
- https://access.redhat.com/errata/RHSA-2018:2867
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20180817-0001
- https://web.archive.org/web/20200227102808/http://www.securityfocus.com/bid/104894
- https://web.archive.org/web/20200515223903/http://www.securitytracker.com/id/1041376
- https://www.debian.org/security/2018/dsa-4281
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Verify integrity in audit chain (admin only). AS-IS.