[<prev] [next>] [day] [month] [year] [list]
Message-ID: <64f0e35f-4579-c9a6-5820-693c1b5f8395@apache.org>
Date: Wed, 13 Sep 2023 10:31:03 +0100
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: [SECURITY] CVE-2023-41081 Apache Tomcat Connectors (mod_jk)
Information Disclosure
CVE-2023-41081 Apache Tomcat Connectors (mod_jk) Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- Apache Tomcat Connectors mod_jk Connector 1.2.0 to 1.2.48
Description:
In some circumstances, such as when a configuration included
"JkOptions +ForwardDirectories" but the configuration did not provide
explicit mounts for all possible proxied requests, mod_jk would use an
implicit mapping and map the request to the first defined worker. Such
an implicit mapping could result in the unintended exposure of the
status worker and/or bypass security constraints configured in httpd. As
of JK 1.2.49, the implicit mapping functionality has been removed and
all mappings must now be via explicit configuration.
Only mod_jk is affected by this issue. The ISAPI redirector is not affected.
Mitigation:
Users of affected versions should apply one of the following mitigations:
- Upgrade to Apache Tomcat Connector (mod_jk) 1.2.49 or later.
- Ensure explicit mounts are configured for all possible proxied
requests
Credit:
This vulnerability was reported responsibly to the Tomcat security team
by Karl von Randow.
References:
[1] http://tomcat.apache.org/security-jk.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
