diff options
| author | erwin <erwin@FreeBSD.org> | 2007-06-05 17:38:17 +0800 |
|---|---|---|
| committer | erwin <erwin@FreeBSD.org> | 2007-06-05 17:38:17 +0800 |
| commit | 40547eb187e6808a2c05a609181242f9cdd92ecb (patch) | |
| tree | da8a2b38ee0ab0a64ae9ccc37ef9e3073a970c5d /security | |
| parent | d8587e7bf4d8f3a89a8f1f1de851968e8a1d5151 (diff) | |
| download | freebsd-ports-gnome-40547eb187e6808a2c05a609181242f9cdd92ecb.tar.gz freebsd-ports-gnome-40547eb187e6808a2c05a609181242f9cdd92ecb.tar.zst freebsd-ports-gnome-40547eb187e6808a2c05a609181242f9cdd92ecb.zip | |
Document an information disclosure vulnerability in mod_jk < 1.2.23.
Reviewed by: simon
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 409e6a14a4cf..2b189124933d 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,38 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="d9405748-1342-11dc-a35c-001485ab073e"> + <topic>mod_jk -- information disclosure</topic> + <affects> + <package> + <name>mod_jk</name> + <name>mod_jk-ap2</name> + <range><lt>1.2.23</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Kazu Nambo reports:</p> + <blockquote cite="http://tomcat.apache.org/security-jk.html"> + <p>URL decoding the the Apache webserver prior to + decoding in the Tomcat server could pypass access + control rules and give access to pages on a different + AJP by sending a crafted URL.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2007-1860</cvename> + <url>http://secunia.com/advisories/25383/</url> + <url>http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1</url> + <url>http://tomcat.apache.org/security-jk.html</url> + </references> + <dates> + <discovery>2007-05-18</discovery> + <entry>2007-06-05</entry> + </dates> + </vuln> + <vuln vid="62b8f253-12d9-11dc-a35c-001485ab073e"> <topic>typo3 -- email header injection</topic> <affects> |