CVE-2014-8111

Description

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libapache-mod-jk	1:1.2.40+svn150520-1	—
Debian 13	libapache-mod-jk	1:1.2.40+svn150520-1	—
Debian 12	libapache-mod-jk	1:1.2.40+svn150520-1	—
Debian 8	libapache-mod-jk	1:1.2.37-4+deb8u1	DSA-3278-1
Debian 7	libapache-mod-jk	1:1.2.37-1+deb7u1	DSA-3278-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Debian 6.0	libapache-mod-jk	1:1.2.30-1squeeze2	DLA-240-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 3	mod_bmx	0.9.5-5.GA.ep7.el6	RHEA-2015:1771, RHEA-2015:1770
Red Hat JBoss Web Server 3	mod_cluster +2	1.3.1-8.Final_redhat_3.1.ep7.el6	RHEA-2015:1771, RHEA-2015:1770
Red Hat JBoss Web Server 3	mod_jk +2	1.2.40-8.redhat_1.ep7.el6	RHEA-2015:1771, RHEA-2015:1770
Red Hat JBoss Web Server 3	mod_security-jws3	2.8.0-6.GA.ep7.el6	RHEA-2015:1771, RHEA-2015:1770
Red Hat JBoss Web Server 3	tomcat7 +9	7.0.59-26_patch_00.ep7.el6	RHEA-2015:1771, RHEA-2015:1770
Red Hat JBoss Web Server 3	tomcat8 +9	8.0.18-25_patch_00.ep7.el6	RHEA-2015:1771, RHEA-2015:1770
Red Hat JBoss Web Server 2	mod_cluster-native	1.2.9-4.Final_redhat_2.ep6.el5	RHSA-2015:1642
Red Hat JBoss Web Server 2	mod_jk +2	1.2.40-4.redhat_2.ep6.el5	RHSA-2015:1642
Red Hat JBoss EAP 6	apache-commons-cli-eap6	1.2.0-1.redhat_8.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-codec-eap6	1.4.0-4.redhat_4.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-configuration-eap6	1.6.0-1.redhat_4.2.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-daemon-eap6	1:1.0.15-8.redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-io-eap6	2.1.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-lang-eap6	2.6.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-pool-eap6	1.6.0-1.redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-mime4j	0.6.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	atinject-eap6	1.0.0-1.redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	avro-eap6	1.7.5-2.redhat_2.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	cal10n-eap6	0.7.7-1.redhat_1.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-10.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	eap6-apache-commons-cli	1.2.0-1.redhat_8.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-apache-commons-codec	1.4.0-4.redhat_4.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-apache-commons-configuration	1.6.0-1.redhat_4.2.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-avro	1.7.5-2.redhat_2.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-cal10n	0.7.7-1.redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-ecj	4.4.2-1.redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-jandex	1.2.2-1.Final_redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-jansi	1.9.0-1.redhat_5.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-joda-time	1.6.2-2.redhat_5.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-rngom	201103.0.0-1.redhat_4.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-snakeyaml	1.8.0-1.redhat_3.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	ecj-eap6	4.4.2-1.redhat_1.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jaf	1.1.1-17.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-javamail	1.4.5-2.redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jsf-eap6	2.1.28-7.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jsf12-eap6	1.2.15-8.b01_redhat_12.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate-beanvalidation-api	1.0.0-5.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate-jpa-2.0-api +2	1.0.1-6.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate3-commons-annotations	4.0.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-eap6 +4	4.2.18-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-search	4.6.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-validator	4.3.2-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hornetq	2.3.25-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hornetq-native +1	2.3.25-3.Final_redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpcomponents-eap6 +1	7.0.0-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpcore-eap6 +1	4.3.3-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpd +3	2.2.26-38.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpd22 +3	2.2.26-38.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	httpmime-eap6 +2	4.3.6-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpserver	1.0.4-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	infinispan +4	5.2.11-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.31-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jansi-eap6	1.9.0-1.redhat_5.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	javassist-eap6	3.18.1-6.GA_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-deployment	1.3.0-5.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-framework-core	2.1.0-5.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-metadata	2.2.0-4.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-repository	2.1.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-resolver	3.0.1-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-spi	3.2.0-3.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-vfs	1.2.1-5.Final_redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-aesh	0.33.14-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-as-ee +53	7.5.0-8.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-classfilewriter	1.0.3-3.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-common-beans	1.1.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-common-core	1:2.2.17-11.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-connector-api_1.6_spec +1	1.0.1-5.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-dmr +1	1.2.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-ejb-api_3.1_spec	1.0.2-11.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.30-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-genericjms	1.0.7-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-hal +1	2.5.5-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-iiop-client	1.0.0-5.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jad-api_1.2_spec +1	1.0.1-7.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxb-api_2.2_spec	1.0.4-4.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxr-api_1.0_spec	1.0.2-6.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxrpc-api_1.1_spec	1.0.1-5.Final_redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxrs-api_1.1_spec +1	1.0.1-10.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jms-api_1.1_spec +1	1.0.1-13.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jsp-api_2.2_spec	1.0.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-logging	3.1.4-2.GA_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-logmanager	1.5.4-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-metadata +5	7.2.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-modules	1.3.6-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-osgi-logging	1.0.0-7.redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-remote-naming	1.0.10-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-rmi-api_1.0_spec	1.0.4-10.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-sasl	1.0.5-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-seam-int	6.0.0-10.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-servlet-api_3.0_spec	1.0.2-4.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-threads	2.1.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-vfs2	3.2.9-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-weld-1.1-api	1.1.0-1.Final_redhat_6.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-xnio-base	3.0.13-1.GA_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-core	7.5.0-11.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-domain +5	7.5.0-9.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-javadocs	7.5.0-23.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-modules-eap	7.5.0-14.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossts	1:4.17.29-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossweb	7.5.7-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossxb2	2.0.3-15.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jcip-annotations-eap6	1.0.0-1.redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jdom-eap6	1.1.3-1.redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	joda-time-eap6	1.6.2-2.redhat_5.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jul-to-slf4j-stub	1.0.1-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	log4j-jboss-logmanager	1.1.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	lucene-solr	3.6.2-5.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_cluster +1	1.2.11-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_cluster-native	1.2.11-2.Final_redhat_2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_jk +1	1.2.40-3.redhat_2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_rt	2.4.1-6.GA.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_snmp	2.4.1-13.GA.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_ssl	1:2.2.26-38.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_ssl22	1:2.2.26-38.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	objectweb-asm-eap6	3.3.1-8.redhat_9.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	org.osgi.core-eap6	4.2.0-14.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	org.osgi.enterprise-eap6	4.2.0-15.redhat_10.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketbox	4.1.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketbox-commons	1.0.0-1.final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketlink-bindings +1	2.5.4-5.SP4_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	relaxngDatatype-eap6	2011.1.0-1.redhat_9.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	resteasy	2.3.10-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	rngom-eap6	201103.0.0-1.redhat_4.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	snakeyaml-eap6	1.8.0-1.redhat_3.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	staxmapper	1.1.0-7.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-codemodel	2.6.0-1.redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-txw2	20110809.0.0-1.redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-ws-metadata-2.0-api	1.0.0-2.MR1_redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-xsom	20110809.0.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	tomcat-native +1	1.1.32-3.redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	velocity-eap6	1.7.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	weld-cdi-1.0-api	1.0.0-1.SP4_redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	xml-commons-resolver-eap6	1.2.0-1.redhat_10.2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12	apache2	2.4.10-14.10.1	SUSE-SU-2015:1851-1
SLES 12	apache2-mod_auth_kerb	5.4-2.4.1	SUSE-SU-2015:1851-1
SLES 12	apache2-mod_jk	1.2.40-2.6.1	SUSE-SU-2015:1851-1
SLES 12	apache2-mod_security2	2.8.0-3.4.1	SUSE-SU-2015:1851-1
SLES 11 SP4	apache2-mod_jk	1.2.40-0.2.5.1	SUSE-SU-2018:3970-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12	apache2	2.4.10-14.10.1	SUSE-SU-2015:1851-1
SLES for SAP 12	apache2-mod_auth_kerb	5.4-2.4.1	SUSE-SU-2015:1851-1
SLES for SAP 12	apache2-mod_jk	1.2.40-2.6.1	SUSE-SU-2015:1851-1
SLES for SAP 12	apache2-mod_security2	2.8.0-3.4.1	SUSE-SU-2015:1851-1
SLES for SAP 11 SP4	apache2-mod_jk	1.2.40-0.2.5.1	SUSE-SU-2018:3970-1
SUSE Enterprise Storage 1.0	apache2-mod_fastcgi	2.4.7-3.4.1	SUSE-SU-2015:1851-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	apache2-mod_jk	1.2.41-1.5	openSUSE-SU-2024:10488-1

Advisories 11

RHSA-2015:0848 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2015:0846 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2015:0847 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHEA-2015:1771 Red Hat Enhancement Advisory: Red Hat JBoss Web Server 3.0.1 enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHEA-2015:1770 Red Hat Enhancement Advisory: Red Hat JBoss Web Server 3.0.1 enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
DLA-240-1 libapache-mod-jk - security update Debian Security (DSA / DLA) · Mar 9, 2026
DSA-3278-1 libapache-mod-jk - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2018:3970-1 Security update for apache2-mod_jk SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2015:1851-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
RHSA-2015:1642 Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
openSUSE-SU-2024:10488-1 apache2-mod_jk-1.2.41-1.5 on GA media SUSE / openSUSE Security Updates · May 7, 2025

References

RHSA-2015:1641 vendor-advisory
RHSA-2015:0849 vendor-advisory
DSA-3278 vendor-advisory
RHSA-2015:0848 vendor-advisory
RHSA-2015:0846 vendor-advisory
RHSA-2015:1642 vendor-advisory
RHSA-2015:0847 vendor-advisory
74265 vdb-entry
[tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/ mailing-list

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attacke…

Description

Fixed in Linux distributions

Debian

Red Hat

SUSE

openSUSE

Advisories 11

References