REDHAT-BUG-490201
First published: Fri Mar 13 2009(Updated: )
An issue with mod_jk 1.2.26, and possibly older versions, allows one user to see another user's information due to missing logic where faulty clients set Content-Length without providing data, or if a user submits too many times very fast. The relevant changelog entry in mod_jk 1.2.27 that corrects the issue is: "AJP13: Always send initial POST packet even if the client disconnected after sending request but before providing POST data. In that case or in case the client broke the connection in a middle of read send an zero size packet informing container about broken client connection. (mturk)" from <a href="http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html">http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Mod IMAP | <1.2.27 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html
- http://svn.eu.apache.org/viewvc?view=rev&revision=702540
- http://marc.info/?l=tomcat-dev&m=123913700700879
- https://rhn.redhat.com/errata/RHSA-2009-0446.html
- https://rhn.redhat.com/errata/RHSA-2009-1087.html
- https://rhn.redhat.com/errata/RHSA-2009-1618.html
- https://bugzilla.redhat.com/show_bug.cgi?id=490201
Frequently Asked Questions
What is the severity of REDHAT-BUG-490201?
REDHAT-BUG-490201 is considered a medium severity vulnerability due to potential information leakage between users.
How do I fix REDHAT-BUG-490201?
To fix REDHAT-BUG-490201, upgrade Apache mod_jk to version 1.2.27 or later.
What software is affected by REDHAT-BUG-490201?
REDHAT-BUG-490201 affects Apache mod_jk versions prior to 1.2.27.
What issue does REDHAT-BUG-490201 address?
REDHAT-BUG-490201 addresses an information disclosure issue caused by improper content length handling.
Are older versions of mod_jk vulnerable to REDHAT-BUG-490201?
Yes, versions of mod_jk older than 1.2.27 are vulnerable to REDHAT-BUG-490201.
- collector/redhat-bugzilla
- alias/CVE-2008-5519
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache mod imap