Apache Tomcat Connectors - Incorrect Default Permissions Vulnerability in mod_jk
Summary
CVE-2024-46544: Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of servic... Affects libapache-mod-jk across 2 version ranges.
< 1:1.2.48-1+deb11u2
>= f48d0853cc16db3a62e27f0a1bf3522b8044906f, < 9612683ac09ebb06aca9ad25cdd7274152c6d031
Fixed in 1:1.2.48-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat Connectors is a set of components that facilitate the integration of Apache Tomcat with web servers. The mod_jk connector allows for communication between Apache HTTP Server and Tomcat, enabling load balancing and request forwarding. This package is widely used in Unix-like systems to enhance web server capabilities. However, it has been identified to have a vulnerability related to incorrect default permissions, which can expose sensitive configuration data.
Vulnerability Detail
The vulnerability, identified as CVE-2024-46544, arises from incorrect default permissions in Apache Tomcat Connectors, specifically affecting mod_jk on Unix-like systems. This flaw allows local users to access and modify shared memory that contains mod_jk configuration data. As a result, this could lead to information disclosure, where sensitive configuration details are exposed, or denial of service, where the functionality of the mod_jk connector is compromised. The issue does not affect the ISAPI redirector or mod_jk on Windows systems.
How To Fix
Minimum fixed version
1:1.2.48-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache-mod-jkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can modify the permissions of the shared memory used by mod_jk to restrict access to authorized users only. This can be done by executing the following command:
chmod 700 /path/to/shared_memory_file
Conclusion
The incorrect default permissions vulnerability in Apache Tomcat Connectors (CVE-2024-46544) poses a significant risk to Unix-like systems using mod_jk. Users are strongly advised to upgrade to version 1.2.50 to mitigate this risk. For those unable to upgrade immediately, applying the suggested workaround can help reduce exposure until an upgrade can be performed.
See every vulnerability recorded for libapache-mod-jk →
FAQ
CVE-2024-46544 is a vulnerability in Apache Tomcat Connectors that allows local users to view and modify shared memory containing mod_jk configuration due to incorrect default permissions.
The vulnerability affects Apache Tomcat Connectors from version 1.2.9-beta through 1.2.49.
No, the vulnerability only affects mod_jk on Unix-like systems. The ISAPI redirector and mod_jk on Windows are not impacted.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If an immediate upgrade is not possible, consider applying the temporary workaround by modifying the permissions of the shared memory used by mod_jk.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-mod-jk.
