PT-2009-1291 · Apache +2 · Apache Tomcat +2

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.0 through 4.1.39 Apache Tomcat versions 5.5.0 through 5.5.27 Apache Tomcat versions 6.0.0 through 6.0.18 Description: The issue allows remote attackers to bypass intended access restrictions and conduct directory...

Fixed in Apache Tomcat 6.0.20

Note: These issues were fixed in Apache Tomcat 6.0.19 but the release vote for that release candidate did not pass. Therefore, although users must download 6.0.20 to obtain a version that includes fixes for these issues, 6.0.19 is not included in the list of affected versions. Important:...

RedHat Security Advisory RHSA-2009:0446

The remote host is missing updates announced in advisory RHSA-2009:0446. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to communicate with each other. An information disclosure flaw was found in modjk. In certain situations, if a faulty client set the...

RedHat Security Advisory RHSA-2009:0446

The remote host is missing updates announced in advisory RHSA-2009:0446. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to communicate with each other. An information disclosure flaw was found in modjk. In certain situations, if a faulty client set the...

Important: Red Hat Security Advisory: mod_jk security update

An updated modjk package that fixes a security issue is now available for Red Hat Application Stack v2. This update has been rated as having important security impact by the Red Hat Security Response Team. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to...

Apache Tomcat mod_jk Information Disclosure Vulnerability

This host is running Apache Tomcat with modjk Module and is prone to Information Disclosure vulnerability. OpenVAS Vulnerability Test $Id: gbapachetomcatmodjkinfodiscvuln.nasl 4865 2016-12-28 16:16:43Z teissa $ Apache Tomcat modjk Information Disclosure Vulnerability Authors: Sujit Ghosal...

Apache Tomcat JK Connector (mod_jk) Detection (HTTP)

HTTP based detection of Apache Tomcat JK Connector modjk. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Apache Tomcat JK Connector (mod_jk) 1.2.0 - 1.2.26 Information Disclosure Vulnerability

Apache Tomcat JK Connector modjk is prone to an information disclosure vulnerability. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

CVE-2008-6722

Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to...

Design/Logic Flaw

Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to...

CVE-2008-6722

CVE-2008-6722 affects Novell Access Manager 3 SP4. The vulnerability arises because SSL/X.509 sessions are not expired, allowing physically proximate attackers to reuse a victim’s valid SSL sessionID via the victim’s browser process. This is linked to Apache Tomcat’s failure to clear entries from...

CVE-2008-6722

Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to...

Apache Tomcat mod_jk Content-Length头信息泄露漏洞

BUGTRAQ ID: 34412 CVECAN ID: CVE-2008-5519 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 如果恶意客户端向Apache Tomcat服务器的modjk模块提交了Content-Length头为空的恶意请求，或在短时间内反复提交相同的请求的话，就可以查看其他用户请求相关的响应。 Apache Group modjk 1.2.0 - 1.2.26 Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://httpd.apache.org/...

CVE-2008-5519

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

CVE-2008-5519

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

DEBIAN-CVE-2008-5519

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

Design/Logic Flaw

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

CVE-2008-5519

The CVE refers to the mod_jk (JK Connector) for Apache Tomcat, affected in the 1.2.0–1.2.26 range. The root cause is an error in handling certain HTTP requests, enabling an attacker to obtain sensitive information via Content-Length-related scenarios (e.g., a request with Content-Length but no PO...

CVE-2008-5519

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

Mandriva Update for tomcat5 MDVSA-2008:188 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDVSA-2008:188 tomcat5 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...