2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
53.6%
The Apache Tomcat JK Connector (aka mod_jk) connects the Tomcat application server with the Apache HTTP Server.
The Red Hat Security Response Team discovered that mod_jk does not properly handle (1) requests setting the βContent-Lengthβ header while not providing data and (2) clients sending repeated requests very quickly.
A remote attacker could send specially crafted requests or a large number of requests at a time, possibly resulting in the disclosure of a response intended for another client.
There is no known workaround at this time.
All Apache Tomcat JK Connector users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apache/mod_jk-1.2.27"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | www-apache/mod_jk | <Β 1.2.27 | UNKNOWN |