NetSight
IP …
high7.5

CVE-2018-8034

The host name verification when using TLS with the WebSocket client was missing.

Impact

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

Affected products

VendorProductAffected versions
ApacheTomcat
from 7.0.35 through 7.0.88
from 8.0.0 through 8.0.52
from 8.5.0 through 8.5.31
from 9.0.1 through 9.0.9
Versions 8.0.0, 9.0.0
CanonicalUbuntu Linux
Versions 14.04, 16.04
DebianDebian Linux
Versions 8.0, 9.0
OracleRetail Order Broker
Versions 5.1, 5.2, 15.0

Weakness classification

CWE-295

References