Bug 1645589 (CVE-2018-11759) - CVE-2018-11759 mod_jk: connector path traversal due to mishandled HTTP requests in httpd
Summary: CVE-2018-11759 mod_jk: connector path traversal due to mishandled HTTP reques...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-11759
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1700932 1700933
Blocks: 1645595
TreeView+ depends on / blocked
 
Reported: 2018-11-02 15:14 UTC by Laura Pardo
Modified: 2022-03-13 15:56 UTC (History)
33 users (show)

Fixed In Version: mod_jk 1.2.46
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-10-17 06:51:19 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:0366 0 None None None 2019-02-18 16:55:56 UTC
Red Hat Product Errata RHSA-2019:0367 0 None None None 2019-02-18 16:58:37 UTC

Description Laura Pardo 2018-11-02 15:14:30 UTC
A flaw was found in Apache Tomcat JK mod_jk Connector 1.2.0 to 1.2.44. The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical. 


References:
https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad@%3Cannounce.tomcat.apache.org%3E

Comment 5 errata-xmlrpc 2019-02-18 16:55:55 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2019:0366 https://access.redhat.com/errata/RHSA-2019:0366

Comment 6 errata-xmlrpc 2019-02-18 16:58:35 UTC
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 6
  JBoss Core Services on RHEL 7

Via RHSA-2019:0367 https://access.redhat.com/errata/RHSA-2019:0367

Comment 10 Product Security DevOps Team 2019-10-17 06:51:19 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-11759


Note You need to log in before you can comment on or make changes to this bug.