Apache Tomcat 8

Plugin tenable:121124 maps to CVE-2018-1336. In Apache Tomcat, malformed UTF-8 with supplementary characters can trigger an infinite loop in the decoder and hang request processing. For this specific Nessus plugin, the affected upstream train is Tomcat 8.0.0.RC1 through 8.0.51, fixed in 8.0.52; the broader CVE also affects 7.0.28-7.0.86, 8.5.0-8.5.30, and 9.0.0.M9-9.0.7.

The raw vendor/NVD CVSS 3.1 score of 7.5 HIGH overstates enterprise urgency because it scores the bug as a clean unauthenticated network hit with high availability impact, but ignores the real-world fact that this is still DoS only. No code execution, no auth bypass, no data theft, no persistence. If the request path is fronted by proxies or input normalization, exploitation gets even less reliable. For a 10,000-host patch queue, this belongs below remote code execution and auth bypass flaws.

Why this verdict

• Start from 7.5 HIGH: unauthenticated remote requests can trigger it over the network with low complexity, so the baseline score is not crazy on paper
• Downgrade for impact: the bug buys the attacker only denial of service—no code execution, no data exposure, no privilege gain, no persistence
• Downgrade for attacker path friction: the malformed UTF-8 must survive reverse proxies, WAFs, and app validation to hit Tomcat's decoder; that narrows reliable reach in modern deployments
• Keep it above LOW: public-facing Tomcat is common enough that exposed nodes can still be knocked over if they are directly reachable and unprotected

Why not higher?

This is not a compromise primitive. There is no post-exploitation value, no lateral movement assist, and no credential or data exposure. A DoS-only issue should not compete with remote code execution, auth bypass, or deserialization bugs for the top of your patch queue.

Why not lower?

I would not bury it as backlog hygiene because the trigger is remote and unauthenticated, and Internet-facing Tomcat remains common. If you have brittle customer-facing apps with thin thread pools and no protective proxy layer, this can still produce a very visible outage.

1. Front Tomcat with strict request normalization — Terminate HTTP at a reverse proxy or WAF that rejects malformed UTF-8 before it reaches the Tomcat connector. For a MEDIUM finding there is no mitigation SLA — go straight to the 365-day remediation window, but do this sooner on public apps if you already run a shared edge stack.
2. Rate-limit abusive request patterns — Apply per-IP and per-path throttling at the load balancer, reverse proxy, or API gateway to reduce repeated parser-trigger attempts from consuming worker threads. For MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window; fold this into normal edge-hardening work rather than emergency change control.
3. Validate package provenance before patching — If the asset runs distro-packaged Tomcat, verify backported package versions instead of trusting the upstream-looking banner string. For MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window; the main goal is to avoid false-positive churn on already-fixed Linux packages.
4. Monitor JVM and thread-pool exhaustion — Alert on sudden Tomcat worker depletion, elevated CPU, health-check failures, and repeated malformed-request responses so ops catches availability attacks early. For MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window; use this as resilience tuning, not a fire drill.

Run this on the target Tomcat host as a local shell check, not from your scanner. Invoke it as bash check-cve-2018-1336.sh /opt/tomcat and it needs only read access to the Tomcat install tree; no root is required unless file permissions are locked down.

#!/usr/bin/env bash
# check-cve-2018-1336.sh
# Determine whether an Apache Tomcat 8.0.x installation is vulnerable to CVE-2018-1336
# for the Nessus plugin scope: 8.0.0.RC1 through 8.0.51.
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN: usage: $0 /path/to/tomcat"
  exit 2
fi

if [[ ! -d "$TARGET" ]]; then
  echo "UNKNOWN: path not found: $TARGET"
  exit 2
fi

VERSION=""

# Try RELEASE-NOTES first
if [[ -r "$TARGET/RELEASE-NOTES" ]]; then
  VERSION=$(grep -Eom1 'Apache Tomcat Version [0-9]+\.[0-9]+\.[0-9]+([.-]RC[0-9]+)?' "$TARGET/RELEASE-NOTES" | awk '{print $4}')
fi

# Fallback to serverinfo.sh if present
if [[ -z "$VERSION" && -x "$TARGET/bin/version.sh" ]]; then
  VERSION=$(
    "$TARGET/bin/version.sh" 2>/dev/null | sed -n 's/^Server version:[[:space:]]*Apache Tomcat\///p' | head -n1
  )
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not determine Tomcat version from $TARGET"
  exit 2
fi

# Normalize common RC formats
VERSION="${VERSION//-RC/.RC}"

# This script is intentionally scoped to Tomcat 8.0.x because the Nessus plugin title is:
# Apache Tomcat 8.0.0.RC1 < 8.0.52
if [[ ! "$VERSION" =~ ^8\.0\. ]]; then
  echo "UNKNOWN: detected version $VERSION, outside plugin 121124 scope (Tomcat 8.0.x only)"
  exit 2
fi

# Handle release candidates explicitly
if [[ "$VERSION" =~ ^8\.0\.0\.RC[0-9]+$ ]]; then
  echo "VULNERABLE: detected version $VERSION (within 8.0.0.RC1-8.0.51)"
  exit 1
fi

# Handle GA versions 8.0.N
PATCH=$(echo "$VERSION" | sed -n 's/^8\.0\.\([0-9]\+\)$/\1/p')
if [[ -z "$PATCH" ]]; then
  echo "UNKNOWN: unrecognized Tomcat 8.0 version format: $VERSION"
  exit 2
fi

if (( PATCH < 52 )); then
  echo "VULNERABLE: detected version $VERSION (fixed in 8.0.52+)"
  exit 1
else
  echo "PATCHED: detected version $VERSION"
  exit 0
fi

Sources

1. Tenable plugin 121124
2. Apache Tomcat 8 security page
3. NVD CVE-2018-1336
4. Ubuntu CVE-2018-1336 page
5. Debian CVE tracker
6. Debian DSA-4281-1
7. CISA KEV catalog
8. Censys blog on finding Tomcat