REDHAT-BUG-1382352: Buffer Overflow
The IIS/ISAPI specific code implements special handling when a virtual host is present. The virtual host name and the URI are concatenated to create a virtual host mapping rule. It was found that the length checks prior to writing to the target buffer for this rule did not take account of the length of the virtual host name, creating the potential for a buffer overflow.
Upstream patch:
https://svn.apache.org/viewvc?view=revision&revision=1762057
External References:
https://tomcat.apache.org/security-jk.html#FixedinApacheTomcatJKConnector1.2.42
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1382352?
The severity of REDHAT-BUG-1382352 is considered high due to potential buffer overflow risks.
How do I fix REDHAT-BUG-1382352?
To fix REDHAT-BUG-1382352, update the Apache Tomcat JK Connector to version 1.2.42 or later.
What are the potential impacts of REDHAT-BUG-1382352?
The impacts of REDHAT-BUG-1382352 may include remote code execution and denial of service if exploited.
Which software is affected by REDHAT-BUG-1382352?
REDHAT-BUG-1382352 affects the Apache Tomcat JK Connector versions prior to 1.2.42.
Is REDHAT-BUG-1382352 still a threat if I have upgraded my software?
If you have upgraded your Apache Tomcat JK Connector to version 1.2.42 or later, REDHAT-BUG-1382352 is no longer a threat.