GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Tue Jun 30, 2009 12:26 am Post subject: [ GLSA 200906-04 ] Apache Tomcat JK Connector: Information d |
|
|
Gentoo Linux Security Advisory
Title: Apache Tomcat JK Connector: Information disclosure (GLSA 200906-04)
Severity: low
Exploitable: remote
Date: June 29, 2009
Bug(s): #265455
ID: 200906-04
Synopsis
An error in the Apache Tomcat JK Connector might allow for an information disclosure flaw.
Background
The Apache Tomcat JK Connector (aka mod_jk) connects the Tomcat application server with the Apache HTTP Server.
Affected Packages
Package: www-apache/mod_jk
Vulnerable: < 1.2.27
Unaffected: >= 1.2.27
Architectures: All supported architectures
Description
The Red Hat Security Response Team discovered that mod_jk does not properly handle (1) requests setting the "Content-Length" header while not providing data and (2) clients sending repeated requests very quickly.
Impact
A remote attacker could send specially crafted requests or a large number of requests at a time, possibly resulting in the disclosure of a response intended for another client.
Workaround
There is no known workaround at this time.
Resolution
All Apache Tomcat JK Connector users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=www-apache/mod_jk-1.2.27" |
References
CVE-2008-5519 |
|