[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e211acf3-b142-261d-21e1-ae4494ebc0c6@christopherschultz.net>
Date: Thu, 28 Sep 2023 16:45:36 -0400
From: Christopher Schultz <chris@...istopherschultz.net>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-41081: Apache Tomcat Connectors: Unexpected use of first
declared worker in mod_jk for unmapped request [CORRECTION]
Severity: important
Affected versions:
- Apache Tomcat Connectors 1.2.0 through 1.2.48
Description:
Important: Authentication Bypass CVE-2023-41081
The mod_jk component of Apache Tomcat Connectors in some circumstances,
such as when a configuration included "JkOptions +ForwardDirectories"
but the configuration did not provide explicit mounts for all
possible proxied requests, mod_jk would use an implicit mapping
and map the request to the first defined worker. Such an implicit
mapping could result in the unintended exposure of the status worker
and/or bypass security constraints configured in httpd. As of JK 1.2.49,
the implicit mapping functionality has been removed and all mappings
must now be via explicit configuration. Only mod_jk is affected by this
issue. The ISAPI redirector is not affected.
This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0
through 1.2.48.
Users are recommended to upgrade to version 1.2.49, which fixes the issue.
History
2023-09-13 Original advisory
2023-09-28 Updated summary
Credit:
Karl von Randow (finder)
References:
https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b
https://tomcat.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-41081
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
