CVE-2024-46544: Apache Tomcat Connectors: mod_jk: local users can view and modify configuration
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing modjk configuration which may lead to information disclosure and/or denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libapache-mod-jkto a version that resolves this vulnerability.Fixed in 1:1.2.48-1+deb11u2Fixed in 1:1.2.48-2+deb12u2Fixed in 1:1.2.50-1 - Upgrade
Upgrade
Apache Tomcat Connectors: mod_jkto a version that resolves this vulnerability.Fixed in 1.2.50
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46544?
CVE-2024-46544 has a severity rating that indicates it could lead to information disclosure and denial of service due to incorrect default permissions.
How do I fix CVE-2024-46544?
To fix CVE-2024-46544, ensure that the permissions for shared memory containing mod_jk configuration are properly configured to prevent unauthorized access.
What versions of Apache Tomcat Connectors are affected by CVE-2024-46544?
CVE-2024-46544 affects Apache Tomcat Connectors versions from 1.2.9-beta to 1.2.50.
What are the potential impacts of CVE-2024-46544?
The potential impacts of CVE-2024-46544 include unauthorized access to sensitive configuration data and possible service interruptions.
Who is impacted by CVE-2024-46544?
Local users of systems running affected versions of Apache Tomcat Connectors may be impacted by CVE-2024-46544.