An updated mod_jk package that fixes one security issue is now available for Red Hat Network Satellite Server 5.1 and 5.2.

This update has been rated as having low security impact by the Red Hat Security Response Team.

mod_jk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to communicate with each other.

An information disclosure flaw was found in mod_jk. In certain situations, if a faulty client set the 'Content-Length' header without providing data, or if a user sent repeated requests very quickly, one user may view a response intended for another user. (CVE-2008-5519)

Note: Red Hat Network Satellite Server is the only client that has access to mod_jk on the system, and as such, the exposure and risk of this issue is low.

Users of Red Hat Network Satellite Server 5.1 and 5.2 are advised to upgrade to this updated mod_jk package, which contains a backported patch to correct this issue.

Certain HTTP request could confuse the JK connector in Apache Tomcat which could result in a user seeing responses destined for other users (CVE-2008-5519).

SunOS 5.10: Apache 1.3 Patch.
Date this patch was last updated by Sun : Nov/12/15

SunOS 5.10_x86: Apache 1.3 Patch.
Date this patch was last updated by Sun : Mar/02/16

Based on the Server response header, the installation of the JK Connector (mod_jk) in Apache Tomcat listening on the remote host is version 1.2.x prior to 1.2.27. It is, therefore, affected by an information disclosure vulnerability. A remote attacker can view the response associated with a different user's request, either by sending a request with a Content-Length without data or by sending repeated requests very quickly. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SunOS 5.10: Apache 1.3 Patch.
Date this patch was last updated by Sun : Jul/11/13

SunOS 5.10: Apache 1.3 Patch.
Date this patch was last updated by Sun : Jul/13/15

SunOS 5.10: Apache 1.3 Patch.
Date this patch was last updated by Sun : Mar/02/16

SunOS 5.10_x86: Apache 1.3 Patch.
Date this patch was last updated by Sun : Jul/11/13

SunOS 5.10_x86: Apache 1.3 Patch.
Date this patch was last updated by Sun : Mar/15/14

SunOS 5.10_x86: Apache 1.3 Patch.
Date this patch was last updated by Sun : Jul/13/15

ID	Name	Product	Family	Published	Updated	Severity
43846	RHEL 4 : mod_jk in Satellite Server (RHSA-2009:1618)	Nessus	Red Hat Local Security Checks	1/10/2010	1/14/2021	low
42397	openSUSE 10 Security Update : apache2-mod_jk (apache2-mod_jk-6599)	Nessus	SuSE Local Security Checks	11/5/2009	1/14/2021	low
107384	Solaris 10 (sparc) : 122911-35	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107887	Solaris 10 (x86) : 122912-36	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
46885	Apache Tomcat JK Connector Content-Length Header Cross-User Information Disclosure	Nessus	Web Servers	6/14/2010	4/11/2022	low
107381	Solaris 10 (sparc) : 122911-32	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107383	Solaris 10 (sparc) : 122911-34	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107385	Solaris 10 (sparc) : 122911-36	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107883	Solaris 10 (x86) : 122912-32	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107884	Solaris 10 (x86) : 122912-33	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107885	Solaris 10 (x86) : 122912-34	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
42389	openSUSE Security Update : apache2-mod_jk (apache2-mod_jk-1479)	Nessus	SuSE Local Security Checks	11/5/2009	1/14/2021	low

Detections

Analytics

Plugins Search

low

low

medium

medium

low

medium

medium

medium

medium

medium

medium

low