Bug 1645589 (CVE-2018-11759)

Summary:	CVE-2018-11759 mod_jk: connector path traversal due to mishandled HTTP requests in httpd
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bkundal, bmaxwell, cdewolf, chazlett, csutherl, darran.lofthouse, deesharm, dimitris, dosoudil, fgavrilo, gzaronik, jawilson, jclere, jdoyle, jondruse, jreznik, krathod, lgao, mbabacek, mturk, myarboro, pgier, ppalaga, psakar, pslavice, rnetuka, rstancel, rsvoboda, twalsh, vtunka, weli, yoeum, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mod_jk 1.2.46	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-10-17 06:51:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1700932, 1700933
Bug Blocks:	1645595

Description Laura Pardo 2018-11-02 15:14:30 UTC

A flaw was found in Apache Tomcat JK mod_jk Connector 1.2.0 to 1.2.44. The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical. 


References:
https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad@%3Cannounce.tomcat.apache.org%3E

Comment 5 errata-xmlrpc 2019-02-18 16:55:55 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2019:0366 https://access.redhat.com/errata/RHSA-2019:0366

Comment 6 errata-xmlrpc 2019-02-18 16:58:35 UTC

This issue has been addressed in the following products:

  JBoss Core Services on RHEL 6
  JBoss Core Services on RHEL 7

Via RHSA-2019:0367 https://access.redhat.com/errata/RHSA-2019:0367

Comment 10 Product Security DevOps Team 2019-10-17 06:51:19 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-11759