First published: Wed Sep 13 2023(Updated: )
Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary
Credit: security@apache.org security@apache.org security@apache.org
Affected Software | Affected Version | How to fix |
---|---|---|
Apache Tomcat Connectors | >=1.2.0<1.2.49 | |
redhat/httpd | <1.2.49 | 1.2.49 |
ubuntu/libapache-mod-jk | <1:1.2.43-1ubuntu0.1~ | 1:1.2.43-1ubuntu0.1~ |
ubuntu/libapache-mod-jk | <1:1.2.46-1ubuntu0.1 | 1:1.2.46-1ubuntu0.1 |
ubuntu/libapache-mod-jk | <1:1.2.48-1ubuntu0.1 | 1:1.2.48-1ubuntu0.1 |
ubuntu/libapache-mod-jk | <1:1.2.48-2ubuntu0.1 | 1:1.2.48-2ubuntu0.1 |
ubuntu/libapache-mod-jk | <1.2.49 | 1.2.49 |
ubuntu/libapache-mod-jk | <1:1.2.41-1ubuntu0.1~ | 1:1.2.41-1ubuntu0.1~ |
debian/libapache-mod-jk | 1:1.2.48-1+deb11u1 1:1.2.48-2+deb12u1 1:1.2.49-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.