Описание
Security update for apache2-mod_jk
This update for apache2-mod_jk fixes the following issues:
Security issues fixed:
- CVE-2018-11759: Fixed connector path traversal due to mishandled HTTP requests in httpd (bsc#1114612).
- CVE-2014-8111: Apache Tomcat Connectors (mod_jk) ignored JkUnmount rules for subtrees of previous JkMount rules, which allowed remote attackers to access otherwise restricted artifacts via unspecified vectors (bsc#927845).
Список пакетов
SUSE Linux Enterprise Server 11 SP4
SUSE Linux Enterprise Server for SAP Applications 11 SP4
Ссылки
- Link for SUSE-SU-2018:3970-1
- E-Mail link for SUSE-SU-2018:3970-1
- SUSE Security Ratings
- SUSE Bug 1114612
- SUSE Bug 927845
- SUSE CVE CVE-2014-8111 page
- SUSE CVE CVE-2018-11759 page
Описание
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.
Затронутые продукты
Ссылки
- CVE-2014-8111
- SUSE Bug 927845
Описание
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
Затронутые продукты
Ссылки
- CVE-2018-11759
- SUSE Bug 1114612