Description
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache-mod-jk | 1:1.2.23-1 | — |
| Debian 13 | libapache-mod-jk | 1:1.2.23-1 | — |
| Debian 12 | libapache-mod-jk | 1:1.2.23-1 | — |
| Debian 4.0 | libapache-mod-jk | 1:1.2.18-3etch1 | DSA-1312-1 |
| Debian 3.1 | libapache-mod-jk | 1:1.2.5-2sarge1 | DSA-1312-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | mod_jk +2 | 1.2.20-1.el4s1.5 | RHSA-2007:0379 |
| Red Hat Rhel Application Server 2 | mod_jk +2 | 1.2.20-1jpp_2rh | RHSA-2007:0380 |
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0261 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
Advisories 5
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0380 Red Hat Security Advisory: mod_jk security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1312-1 libapache-mod-jk Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0379 Red Hat Security Advisory: mod_jk security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- DSA-1312 vendor-advisory
- ADV-2007-2732 vdb-entry
- oval:org.mitre.oval:def:6002 vdb-entry signature
- 25701 third-party-advisory
- 29242 third-party-advisory
- 24147 vdb-entry
- 25383 third-party-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- SUSE-SR:2008:005 vendor-advisory
- 34877 vdb-entry
- ADV-2007-1941 vdb-entry
- GLSA-200708-15 vendor-advisory
- RHSA-2007:0379 vendor-advisory
- ADV-2007-3386 vdb-entry
- 1018138 vdb-entry
- 27037 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=306172
- 26512 third-party-advisory
- SSRT071447 vendor-advisory
- http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1
- http://tomcat.apache.org/security-jk.html
- 25159 vdb-entry
- RHSA-2008:0261 vendor-advisory
- tomcat-jkconnector-security-bypass(34496) vdb-entry
- 26235 third-party-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/ mailing-list