The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.

The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.

apache2-mod_jk-1.2.48-2.9 on GA media

libdb: Reads DB_CONFIG from the current working directory httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values httpd: <FilesMatch> bypass with a trailing newline in the file name openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications httpd: Out of bounds access after failure in reading the HTTP request httpd: Use-after-free on HTTP/2 stream shutdown httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS httpd: Weak Digest auth nonce generation in mod_auth_digest httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS mod_jk: connector path traversal due to mishandled HTTP requests in httpd httpd: DoS for HTTP/2 connections by continuous SETTINGS frames nghttp2: Null pointer dereference when too large ALTSVC frame is received

Security update for apache2-mod_jk

Withdrawn by the publisher.

Affected: Ubuntu:20.04:LTS: libapache-mod-jk

The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tomcat JK Connector ausnutzen, um Sicherheitsvorkehrungen zu umgehen.