Affected: AlmaLinux:9: mod_jk, AlmaLinux:9: mod_proxy_cluster

The mod_jk module is a plugin for the Apache HTTP Server to connect it with the Apache Tomcat servlet engine.

The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.

Security Fix(es):

* httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure (CVE-2023-41081) * mod_cluster/mod_proxy_cluster: Stored Cross site Scripting (CVE-2023-6710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Important: Authentication Bypass CVE-2023-41081

The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.

This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.

Users are recommended to upgrade to version 1.2.49, which fixes the issue.

History 2023-09-13 Original advisory

2023-09-28 Updated summary

The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.

This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.

Users are recommended to upgrade to version 1.2.49, which fixes the issue.

openssl: Denial of service by excessive resource usage in verifying X509 policy constraints openssl: Invalid certificate policies in leaf certificates are silently ignored openssl: Certificate policy check not enabled openssl: Possible DoS translating ASN.1 object identifiers openssl: Excessive time spent checking DH keys and parameters OpenSSL: Excessive time spent checking DH q parameter value curl: out of heap memory issue due to missing limit on header quantity curl: heap based buffer overflow in the SOCKS5 proxy handshake curl: cookie injection with none file httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)

mod_cluster/mod_proxy_cluster: Stored Cross site Scripting httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure

Security update for apache2-mod_jk

Affected: Ubuntu:Pro:16.04:LTS: libapache-mod-jk, Ubuntu:Pro:18.04:LTS: libapache-mod-jk, Ubuntu:20.04:LTS: libapache-mod-jk, Ubuntu:22.04:LTS: libapache-mod-jk

Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary

Ein entfernter anonymer Angreifer kann eine Schwachstelle in Apache Tomcat mod_jk Connector ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.