The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
Unable to check for sanity: > no match for package: www-apache/mod_jk-1.2.48
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c5d0264d6572ce14e70a08bc9478a10838ddd3b3 commit c5d0264d6572ce14e70a08bc9478a10838ddd3b3 Author: Conrad Kostecki <conikost@gentoo.org> AuthorDate: 2021-04-04 19:08:53 +0000 Commit: Conrad Kostecki <conikost@gentoo.org> CommitDate: 2021-04-04 19:12:55 +0000 www-apache/mod_jk: bump to version 1.2.48 Closes: https://bugs.gentoo.org/778758 Bug: https://bugs.gentoo.org/780051 Package-Manager: Portage-3.0.18, Repoman-3.0.3 Signed-off-by: Conrad Kostecki <conikost@gentoo.org> www-apache/mod_jk/Manifest | 1 + www-apache/mod_jk/mod_jk-1.2.48.ebuild | 68 ++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2fe9d88f75d60120efe21e4364c343c4b9e6f017 commit 2fe9d88f75d60120efe21e4364c343c4b9e6f017 Author: Conrad Kostecki <conikost@gentoo.org> AuthorDate: 2021-04-04 19:20:42 +0000 Commit: Conrad Kostecki <conikost@gentoo.org> CommitDate: 2021-04-04 19:20:51 +0000 www-apache/mod_jk: drop old version 1.2.42 Dropping old version, as it contains mulitple open security vulnerabilities. Bug: https://bugs.gentoo.org/780051 Package-Manager: Portage-3.0.18, Repoman-3.0.3 Signed-off-by: Conrad Kostecki <conikost@gentoo.org> www-apache/mod_jk/Manifest | 1 - www-apache/mod_jk/files/88_mod_jk.conf | 165 -------------------------- www-apache/mod_jk/files/jk-workers.properties | 36 ------ www-apache/mod_jk/mod_jk-1.2.42.ebuild | 60 ---------- 4 files changed, 262 deletions(-)
Since old version is dropped, we can wait the usable 30 days for stable.
x86 stable
amd64 stable. Maintainer(s), please cleanup.
Cleanup is done.
Thanks!
Package list is empty or all packages have requested keywords.
