Stay Secure with the Latest Linux Advisories

security advisoryDebianconfiguration issue

Debian: DLA-3580-1 CVE-2023-41081 Moderate: mod_jk Service Exposure

The mod_jk component of Apache Tomcat Connectors, an Apache 2 module to forward requests from Apache to Tomcat, in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3580-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Markus Koschany September 24, 2023 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : libapache-mod-jk Version : 1:1.2.46-1+deb10u2 CVE ID : CVE-2023-41081 Debian Bug : 1051956 The mod_jk component of Apache Tomcat Connectors, an Apache 2 module to forward requests from Apache to Tomcat, in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of this security update, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. This issue affects Apache Tomcat Connectors (mod_jk only). For Debian 10 buster, this problem has been fixed in version 1:1.2.46-1+deb10u2. We recommend that you upgrade your libapache-mod-jk packages. For the detailed security status of libapache-mod-jk please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/libapache-mod-jk Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . DebianLTS Advisory DLA-3581-1 tackles vulnerability in mod_ssl component by implementing enhanced security measures through configuration adjustments.. Debian LTS, mod_jk, Apache Tomcat, security update. . Severity: Important. LinuxSecurity.com Team

Sep 24, 2023 •Important Debian LTS