Summary
Karl von Randow discovered that mod_jk was vulnerable to an authentication
bypass. If the configuration did not provide explicit mounts for all
possible proxied requests, an attacker could possibly use this
vulnerability to bypass security constraints configured in httpd.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libapache-mod-jk | 1:1.2.46-1ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | libapache-mod-jk | 1:1.2.48-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libapache-mod-jk | 1:1.2.41-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libapache-mod-jk | 1:1.2.43-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
High 7.5
Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request
Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possibl…
References
-
report
https://ubuntu.com/security/CVE-2023-41081