This vulnerability in Apache Tomcat Native and Apache Tomcat involves improper input validation related to OCSP responder responses. Specifically, Tomcat Native and Tomcat's FFM port did not fully verify or check the freshness of OCSP responses, which could allow an attacker to bypass certificate revocation checks. Affected versions include Apache Tomcat Native from 1.3.0 through 1.3.4 and 2.0.0 through 2.0.11, and Apache Tomcat from 11.0.0-M1 through 11.0.17, 10.1.0-M7 through 10.1.51, and 9.0.83 through 9.0.114. End-of-life versions from 1.1.23 through 1.1.34 and 1.2.0 through 1.2.39 are also affected. The issue is resolved in Apache Tomcat Native versions 1.3.5 and later or 2.0.12 and later, and Apache Tomcat versions 11.0.18 or later, 10.1.52 or later, and 9.0.115 or later. Red Hat advisories confirm the availability of fixes in their JBoss Web Server packages.

The vulnerability allows bypassing certificate revocation checks by exploiting incomplete verification of OCSP responses. This can lead to acceptance of revoked certificates, potentially undermining the security of TLS connections relying on OCSP for revocation status. The CVSS v3.1 base score is 7.4 (High), indicating a significant impact on confidentiality and integrity without affecting availability. No known exploits in the wild have been reported at this time.

A fix is available. Users should upgrade Apache Tomcat Native to version 1.3.5 or later, or 2.0.12 or later, and Apache Tomcat to version 11.0.18 or later, 10.1.52 or later, or 9.0.115 or later. Red Hat has released updated JBoss Web Server packages incorporating these fixes. Applying these updates will remediate the vulnerability. No other specific mitigations are indicated by the vendor advisories.