CVE-2018-11759

The Apache Web Server (httpd) specific code that normalised the requested
path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk)
Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only
a sub-set of the URLs supported by Tomcat were exposed via httpd, then it
was possible for a specially constructed request to expose application
functionality through the reverse proxy that was not intended for clients
accessing the application via the reverse proxy. It was also possible in
some configurations for a specially constructed request to bypass the
access controls configured in httpd. While there is some overlap between
this issue and CVE-2018-1323, they are not identical.