CVE-2007-0774
NoneCVSS
—
EPSS
81.5%
Published
Mar 4, 2007
CISA due date
—
The record
Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | libapache-mod-jk | 0 | 1:1.2.21-1 |
| Debian:11 | libapache-mod-jk | 0 | 1:1.2.21-1 |
| Debian:12 | libapache-mod-jk | 0 | 1:1.2.21-1 |
| Debian:13 | libapache-mod-jk | 0 | 1:1.2.21-1 |
| Red Hat:rhel_application_server:2 | mod_jk | 0 | 0:1.2.20-1jpp_1rh |
| Red Hat:rhel_application_server:2 | mod_jk-ap20 | 0 | 0:1.2.20-1jpp_1rh |
| Red Hat:rhel_application_server:2 | mod_jk-debuginfo | 0 | 0:1.2.20-1jpp_1rh |
| Red Hat:rhel_application_server:2 | mod_jk-manual | 0 | 0:1.2.20-1jpp_1rh |
| Red Hat:rhel_application_stack:1 | mod_jk | 0 | 0:1.2.20-1.el4s1.2 |
| Red Hat:rhel_application_stack:1 | mod_jk-ap20 | 0 | 0:1.2.20-1.el4s1.2 |
| Red Hat:rhel_application_stack:1 | mod_jk-debuginfo | 0 | 0:1.2.20-1.el4s1.2 |
| Red Hat:rhel_application_stack:1 | mod_jk-manual | 0 | 0:1.2.20-1.el4s1.2 |
| openSUSE:Tumbleweed | apache2-mod_jk | 0 | 1.2.48-2.9 |
Related vulnerabilities
- CVE-2018-11759 The Apache Web Server (httpd) specific code that normalised the requested path before… Also affects libapache-mod-jk
- CVE-2007-1860 mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs… Also affects libapache-mod-jk
- CVE-2018-1323 The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that… Also affects apache2-mod_jk