REDHAT-BUG-2314194: Medium severity Apache Tomcat Connectors vulnerability
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing modjk configuration which may lead to information disclosure and/or denial of service.
This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only modjk on Unix like systems is affected. Neither the ISAPI redirector nor modjk on Windows is affected.
Users are recommended to upgrade to version 1.2.50, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcat Connectors (mod_jk on Unix-like systems)to a version that resolves this vulnerability.Fixed in 1.2.50
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2314194?
The severity of REDHAT-BUG-2314194 is considered critical due to the potential for information disclosure and denial of service.
How do I fix REDHAT-BUG-2314194?
To fix REDHAT-BUG-2314194, update your Apache Tomcat Connectors to a version that is not affected, specifically beyond version 1.2.49.
What systems are affected by REDHAT-BUG-2314194?
REDHAT-BUG-2314194 affects Apache Tomcat Connectors from version 1.2.9-beta through 1.2.49.
What potential risks does REDHAT-BUG-2314194 pose?
REDHAT-BUG-2314194 poses risks of local users being able to view and modify sensitive mod_jk configuration information.
Is there a workaround for REDHAT-BUG-2314194?
Currently, there are no recommended workarounds for REDHAT-BUG-2314194; upgrading to a patched version is advised.