1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200906-04 / mod_jk |
| Release Date | June 29, 2009 |
| Latest Revision | June 29, 2009: 01 |
| Impact | low |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| www-apache/mod_jk | < 1.2.27 | >= 1.2.27 | All supported architectures |
Related bugreports: #265455
An error in the Apache Tomcat JK Connector might allow for an information disclosure flaw.
The Apache Tomcat JK Connector (aka mod_jk) connects the Tomcat application server with the Apache HTTP Server.
The Red Hat Security Response Team discovered that mod_jk does not properly handle (1) requests setting the "Content-Length" header while not providing data and (2) clients sending repeated requests very quickly.
A remote attacker could send specially crafted requests or a large number of requests at a time, possibly resulting in the disclosure of a response intended for another client.
There is no known workaround at this time.
All Apache Tomcat JK Connector users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apache/mod_jk-1.2.27" |