mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server
2.2.11 allows remote attackers to obtain sensitive response data,
intended for a client that sent an earlier POST request with no
request body, via an HTTP request.
Created attachment 190062 [details, diff]
Temporary patch from upstream
Upstream released a preliminary patch for this issue.
patch added to 2.2.11-r1, stabilization should probably be done in a new bug, since multiple issues have been fixed with 2.2.11-r1
Thanks, stabilization handled in 276589.
GLSA 200907-04, thanks everyone.