Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 13 Sep 2023 10:31:03 +0100
From: Mark Thomas <>
Subject: [SECURITY] CVE-2023-41081 Apache Tomcat Connectors (mod_jk)
 Information Disclosure

CVE-2023-41081 Apache Tomcat Connectors (mod_jk) Information Disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
- Apache Tomcat Connectors mod_jk Connector 1.2.0 to 1.2.48

In some circumstances, such as when a configuration included
"JkOptions +ForwardDirectories" but the configuration did not provide 
explicit mounts for all possible proxied requests, mod_jk would use an 
implicit mapping and map the request to the first defined worker. Such 
an implicit mapping could result in the unintended exposure of the 
status worker and/or bypass security constraints configured in httpd. As 
of JK 1.2.49, the implicit mapping functionality has been removed and 
all mappings must now be via explicit configuration.
Only mod_jk is affected by this issue. The ISAPI redirector is not affected.

Users of affected versions should apply one of the following mitigations:
- Upgrade to Apache Tomcat Connector (mod_jk) 1.2.49 or later.
- Ensure explicit mounts are configured for all possible proxied

This vulnerability was reported responsibly to the Tomcat security team 
by Karl von Randow.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.