oss-security - CVE-2008-5519: mod_jk session information leak vulnerability

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Wed, 8 Apr 2009 12:23:15 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2008-5519: mod_jk session information leak vulnerability

Just a heads up for those of you shipping mod_jk.  There is a session
leak vulnerability where, in certain circumstances, client A can get the
responses intended for client B.

This was fixed upstream in version 1.2.27 but the security ramifications
weren't known at that point.

https://bugzilla.redhat.com/show_bug.cgi?id=490201

Our bug has a few more details.

http://svn.eu.apache.org/viewvc?view=rev&revision=702540

This is the upstream fix for the issue.

The issue has the CVE name CVE-2008-5519.

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.