Apache Tomcat Connectors Vulnerability in libapache-mod-jk: Incorrect Default Permissions
Summary
DEBIAN-CVE-2024-46544: Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of servic... Affects libapache-mod-jk versions < 1:1.2.48-1+deb11u2. Fixed in 1:1.2.48-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libapache-mod-jk is a connector module for Apache Tomcat that allows communication between the Apache HTTP Server and Tomcat. It is widely used in web applications to facilitate the integration of Java-based applications with the Apache server. This package is crucial for enabling efficient request handling and load balancing between the two servers. However, it has been found to have a vulnerability that affects its default permissions, which can lead to serious security issues.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-46544 is an Incorrect Default Permissions issue in Apache Tomcat Connectors. This flaw allows local users to access and modify shared memory that contains the mod_jk configuration. Such unauthorized access can lead to information disclosure or denial of service, particularly on Unix-like systems. The affected versions range from 1.2.9-beta through 1.2.49, while the ISAPI redirector and mod_jk on Windows are not impacted.
How To Fix
Minimum fixed version
1:1.2.48-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache-mod-jkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the shared memory used by mod_jk or configure the permissions more securely. However, upgrading to the patched version is the recommended solution to fully mitigate the risk.
Conclusion
The Incorrect Default Permissions vulnerability in libapache-mod-jk poses significant risks to systems running affected versions. Users are strongly advised to upgrade to the latest patched versions to ensure their systems are secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for libapache-mod-jk →
FAQ
The vulnerability allows local users to view and modify shared memory containing mod_jk configuration, potentially leading to information disclosure or denial of service.
The affected versions are from 1.2.9-beta through 1.2.49. Versions 1.2.50 and later are not affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
No, the vulnerability only affects mod_jk on Unix-like systems. The ISAPI redirector and mod_jk on Windows are not impacted.
If immediate upgrading is not possible, consider implementing stricter access controls on the shared memory used by mod_jk as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libapache-mod-jk.
