Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 8 Apr 2009 12:23:15 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2008-5519: mod_jk session information leak vulnerability

Just a heads up for those of you shipping mod_jk.  There is a session
leak vulnerability where, in certain circumstances, client A can get the
responses intended for client B.

This was fixed upstream in version 1.2.27 but the security ramifications
weren't known at that point.

https://bugzilla.redhat.com/show_bug.cgi?id=490201

Our bug has a few more details.

http://svn.eu.apache.org/viewvc?view=rev&revision=702540

This is the upstream fix for the issue.

The issue has the CVE name CVE-2008-5519.

-- 
Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.