Summary
The mod_jk module is a plugin for the Apache HTTP Server to connect it with the Apache Tomcat servlet engine.
The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.
Security Fix(es):
* httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure (CVE-2023-41081)
* mod_cluster/mod_proxy_cluster: Stored Cross site Scripting (CVE-2023-6710)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | mod_jk | 1.2.49-1.el9_4 |
| AlmaLinux · 9 | mod_proxy_cluster | 1.3.20-1.el9_4 |
Vulnerabilities 2
-
High 7.5
Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request
Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possibl…
-
Medium 5.4CVE-2023-6710 Public exploit
Mod_cluster/mod_proxy_cluster: stored cross site scripting
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter…