Lucene search

[email protected]CVE-2008-5519

HistoryApr 09, 2009 - 3:08 p.m.

CVE-2008-5519

2009-04-0915:08:35

CWE-200

[email protected]

web.nvd.nist.gov

cve-2008-5519

jk connector

mod_jk

apache tomcat

remote attackers

sensitive information

http client

nvd

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.3%

JSON

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol’s requirements for requests containing Content-Length headers.

Affected configurations

NVD

Node

apachemod_jkMatch1.2

apachemod_jkMatch1.2.1

apachemod_jkMatch1.2.6

apachemod_jkMatch1.2.7

apachemod_jkMatch1.2.8

apachemod_jkMatch1.2.9

apachemod_jkMatch1.2.10

apachemod_jkMatch1.2.11

apachemod_jkMatch1.2.12

apachemod_jkMatch1.2.13

apachemod_jkMatch1.2.14

apachemod_jkMatch1.2.14.1

apachemod_jkMatch1.2.15

apachemod_jkMatch1.2.16

apachemod_jkMatch1.2.17

apachemod_jkMatch1.2.18

apachemod_jkMatch1.2.19

apachemod_jkMatch1.2.20

apachemod_jkMatch1.2.21

apachemod_jkMatch1.2.22

apachemod_jkMatch1.2.23

apachemod_jkMatch1.2.24

apachemod_jkMatch1.2.25

apachemod_jkMatch1.2.26

Node

apachetomcatMatch4.0.0

apachetomcatMatch4.0.1

apachetomcatMatch4.0.2

apachetomcatMatch4.0.3

apachetomcatMatch4.0.4

apachetomcatMatch4.0.5

apachetomcatMatch4.0.6

apachetomcatMatch4.1.0

apachetomcatMatch4.1.1

apachetomcatMatch4.1.2

apachetomcatMatch4.1.3

apachetomcatMatch4.1.3beta

apachetomcatMatch4.1.4

apachetomcatMatch4.1.5

apachetomcatMatch4.1.6

apachetomcatMatch4.1.7

apachetomcatMatch4.1.8

apachetomcatMatch4.1.9

apachetomcatMatch4.1.9beta

apachetomcatMatch4.1.10

apachetomcatMatch4.1.11

apachetomcatMatch4.1.12

apachetomcatMatch4.1.13

apachetomcatMatch4.1.14

apachetomcatMatch4.1.15

apachetomcatMatch4.1.16

apachetomcatMatch4.1.17

apachetomcatMatch4.1.18

apachetomcatMatch4.1.19

apachetomcatMatch4.1.20

apachetomcatMatch4.1.21

apachetomcatMatch4.1.22

apachetomcatMatch4.1.23

apachetomcatMatch4.1.24

apachetomcatMatch4.1.25

apachetomcatMatch4.1.26

apachetomcatMatch4.1.27

apachetomcatMatch4.1.28

apachetomcatMatch4.1.29

apachetomcatMatch4.1.30

apachetomcatMatch4.1.31

apachetomcatMatch4.1.32

apachetomcatMatch4.1.33

apachetomcatMatch4.1.34

apachetomcatMatch4.1.35

apachetomcatMatch4.1.36

apachetomcatMatch5.0.0

apachetomcatMatch5.0.1

apachetomcatMatch5.0.2

apachetomcatMatch5.0.3

apachetomcatMatch5.0.4

apachetomcatMatch5.0.5

apachetomcatMatch5.0.6

apachetomcatMatch5.0.7

apachetomcatMatch5.0.8

apachetomcatMatch5.0.9

apachetomcatMatch5.0.10

apachetomcatMatch5.0.11

apachetomcatMatch5.0.12

apachetomcatMatch5.0.13

apachetomcatMatch5.0.14

apachetomcatMatch5.0.15

apachetomcatMatch5.0.16

apachetomcatMatch5.0.17

apachetomcatMatch5.0.18

apachetomcatMatch5.0.19

apachetomcatMatch5.0.21

apachetomcatMatch5.0.22

apachetomcatMatch5.0.23

apachetomcatMatch5.0.24

apachetomcatMatch5.0.25

apachetomcatMatch5.0.26

apachetomcatMatch5.0.27

apachetomcatMatch5.0.28

apachetomcatMatch5.0.29

apachetomcatMatch5.0.30

apachetomcatMatch5.5.0

apachetomcatMatch5.5.1

apachetomcatMatch5.5.2

apachetomcatMatch5.5.3

apachetomcatMatch5.5.4

apachetomcatMatch5.5.5

apachetomcatMatch5.5.6

apachetomcatMatch5.5.7

apachetomcatMatch5.5.8

apachetomcatMatch5.5.9

apachetomcatMatch5.5.10

apachetomcatMatch5.5.11

apachetomcatMatch5.5.12

apachetomcatMatch5.5.13

apachetomcatMatch5.5.14

apachetomcatMatch5.5.15

apachetomcatMatch5.5.16

apachetomcatMatch5.5.17

apachetomcatMatch5.5.18

apachetomcatMatch5.5.19

apachetomcatMatch5.5.20

apachetomcatMatch5.5.21

apachetomcatMatch5.5.22

apachetomcatMatch5.5.23

apachetomcatMatch5.5.24

apachetomcatMatch5.5.25

apachetomcatMatch5.5.26

apachetomcatMatch5.5.27

CPENameOperatorVersion
apache:mod_jkapache mod jkeq1.2
apache:mod_jkapache mod jkeq1.2.1
apache:mod_jkapache mod jkeq1.2.6
apache:mod_jkapache mod jkeq1.2.7
apache:mod_jkapache mod jkeq1.2.8
apache:mod_jkapache mod jkeq1.2.9
apache:mod_jkapache mod jkeq1.2.10
apache:mod_jkapache mod jkeq1.2.11
apache:mod_jkapache mod jkeq1.2.12
apache:mod_jkapache mod jkeq1.2.13

CPE	Name	Operator	Version
apache:mod_jk	apache mod jk	eq	1.2
apache:mod_jk	apache mod jk	eq	1.2.1
apache:mod_jk	apache mod jk	eq	1.2.6
apache:mod_jk	apache mod jk	eq	1.2.7
apache:mod_jk	apache mod jk	eq	1.2.8
apache:mod_jk	apache mod jk	eq	1.2.9
apache:mod_jk	apache mod jk	eq	1.2.10
apache:mod_jk	apache mod jk	eq	1.2.11
apache:mod_jk	apache mod jk	eq	1.2.12
apache:mod_jk	apache mod jk	eq	1.2.13

Rows per page:

1-10 of 241

References

lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html

mail-archives.apache.org/mod_mbox/www-announce/200904.mbox/%3C49DBBAC0.2080400%40apache.org%3E

marc.info/?l=tomcat-dev&m=123913700700879

secunia.com/advisories/29283

secunia.com/advisories/34621

secunia.com/advisories/35537

securitytracker.com/id?1022001

sunsolve.sun.com/search/document.do?assetkey=1-26-262468-1

svn.eu.apache.org/viewvc/tomcat/connectors/trunk/jk/native/common/jk_ajp_common.c?r1=702387&r2=702540&pathrev=702540&diff_format=h

svn.eu.apache.org/viewvc/tomcat/connectors/trunk/jk/xdocs/miscellaneous/changelog.xml?view=markup&pathrev=702540

svn.eu.apache.org/viewvc?view=rev&revision=702540

tomcat.apache.org/connectors-doc/miscellaneous/changelog.html

tomcat.apache.org/security-jk.html

www.debian.org/security/2009/dsa-1810

www.openwall.com/lists/oss-security/2009/04/08/10

www.redhat.com/support/errata/RHSA-2009-0446.html

www.securityfocus.com/archive/1/502530/100/0/threaded

www.securityfocus.com/bid/34412

www.vupen.com/english/advisories/2009/0973

bugzilla.redhat.com/show_bug.cgi?id=490201

lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.3%

JSON

Related for CVE-2008-5519

openvas29 tomcat1 seebug1 nessus23 redhat3 debian1 securityvulns2 nvd1 gentoo1 cvelist1 ubuntucve1 veracode1 prion1 debiancve1 ibm1