Debian Linux Security Advisory 4118-1 - Jonas Klempel reported that tomcat-native, a library giving Tomcat access to the Apache Portable Runtime (APR) library's network connection (socket) implementation and random-number generator, does not properly handle fields longer than 127 bytes when parsing the AIA-Extension field of a client certificate. If OCSP checks are used, this could result in client certificates that should have been rejected to be accepted.
b0c115257c6baf6fbce5ba322e1b25311ec19b86eef9ab44de646421e383c4d0