Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 23 Apr 2009 11:11:22 -0600
From: Vincent Danen <>
Subject: CVE-2009-1191: mod_proxy_ajp information disclosure vulnerability

This is just a heads up about an information disclosure vulnerability in
mod_proxy_ajp, similar to the issue in mod_jk (CVE-2008-5519).

This only affects mod_proxy_ajp in httpd 2.2.11; prior versions do not
have this problem.  The issue was caused by the following patch:

The patch that will be applied to httpd 2.2.12 is here:

More information can be found in our bugzilla:

This would only affect earlier versions of Apache if you had backported
the problem patch to earlier versions.

Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.