CVE-2018-11759
High · 7.5CVSS
7.5
EPSS
90.6%
Published
Oct 31, 2018
CISA due date
—
The record
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | libapache-mod-jk | 0 | 1:1.2.46-1 |
| Debian:12 | libapache-mod-jk | 0 | 1:1.2.46-1 |
| Debian:13 | libapache-mod-jk | 0 | 1:1.2.46-1 |
| Debian:8 | libapache-mod-jk | 0 | 1:1.2.46-0+deb8u1 |
| Debian:9 | libapache-mod-jk | 0 | 1:1.2.46-0+deb9u1 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24 | 0 | 0:1-6.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apache-commons-daemon-jsvc | 0 | 1:1.1.0-3.redhat_2.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo | 0 | 1:1.1.0-3.redhat_2.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr | 0 | 0:1.6.3-31.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-debuginfo | 0 | 0:1.6.3-31.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-devel | 0 | 0:1.6.3-31.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-debuginfo | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-devel | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-ldap | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-mysql | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-nss | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-odbc | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-openssl | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-pgsql | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-apr-util-sqlite | 0 | 0:1.6.1-24.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd | 0 | 0:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-debuginfo | 0 | 0:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-devel | 0 | 0:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-manual | 0 | 0:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-selinux | 0 | 0:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-tools | 0 | 0:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_cluster-native | 0 | 0:1.3.8-3.Final_redhat_2.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_cluster-native-debuginfo | 0 | 0:1.3.8-3.Final_redhat_2.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_jk | 0 | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_jk-ap24 | 0 | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_jk-debuginfo | 0 | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_jk-manual | 0 | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_ldap | 0 | 0:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_proxy_html | 0 | 1:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_session | 0 | 0:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_ssl | 0 | 1:2.4.29-35.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-nghttp2 | 0 | 0:1.29.0-9.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-nghttp2-debuginfo | 0 | 0:1.29.0-9.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-nghttp2-devel | 0 | 0:1.29.0-9.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl | 0 | 1:1.0.2n-14.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-debuginfo | 0 | 1:1.0.2n-14.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-devel | 0 | 1:1.0.2n-14.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-libs | 0 | 1:1.0.2n-14.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-perl | 0 | 1:1.0.2n-14.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-static | 0 | 1:1.0.2n-14.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-runtime | 0 | 0:1-6.jbcs.el6 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24 | 0 | 0:1-6.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apache-commons-daemon-jsvc | 0 | 1:1.1.0-3.redhat_2.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo | 0 | 1:1.1.0-3.redhat_2.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr | 0 | 0:1.6.3-31.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-debuginfo | 0 | 0:1.6.3-31.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-devel | 0 | 0:1.6.3-31.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-debuginfo | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-devel | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-ldap | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-mysql | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-nss | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-odbc | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-openssl | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-pgsql | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-apr-util-sqlite | 0 | 0:1.6.1-24.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd | 0 | 0:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-debuginfo | 0 | 0:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-devel | 0 | 0:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-manual | 0 | 0:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-selinux | 0 | 0:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-tools | 0 | 0:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_cluster-native | 0 | 0:1.3.8-3.Final_redhat_2.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_cluster-native-debuginfo | 0 | 0:1.3.8-3.Final_redhat_2.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_jk | 0 | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_jk-ap24 | 0 | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_jk-debuginfo | 0 | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_jk-manual | 0 | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_ldap | 0 | 0:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_proxy_html | 0 | 1:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_session | 0 | 0:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_ssl | 0 | 1:2.4.29-35.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-nghttp2 | 0 | 0:1.29.0-9.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-nghttp2-debuginfo | 0 | 0:1.29.0-9.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-nghttp2-devel | 0 | 0:1.29.0-9.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl | 0 | 1:1.0.2n-14.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-debuginfo | 0 | 1:1.0.2n-14.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-devel | 0 | 1:1.0.2n-14.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-libs | 0 | 1:1.0.2n-14.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-perl | 0 | 1:1.0.2n-14.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-static | 0 | 1:1.0.2n-14.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-runtime | 0 | 0:1-6.jbcs.el7 |
| SUSE:Linux Enterprise Module for Server Applications 15 | apache2-mod_jk | 0 | 1.2.43-3.3.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP4 | apache2-mod_jk | 0 | 1.2.49-150100.6.6.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP5 | apache2-mod_jk | 0 | 1.2.49-150100.6.6.1 |
| SUSE:Linux Enterprise Server 11 SP4 | apache2-mod_jk | 0 | 1.2.40-0.2.5.1 |
| SUSE:Linux Enterprise Server 12 SP4 | apache2-mod_jk | 0 | 1.2.40-7.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | apache2-mod_jk | 0 | 1.2.40-0.2.5.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | apache2-mod_jk | 0 | 1.2.40-7.3.1 |
| Ubuntu:20.04:LTS | libapache-mod-jk | 0 | 1:1.2.46-1 |
| openSUSE:Leap 15.4 | apache2-mod_jk | 0 | 1.2.49-150100.6.6.1 |
| openSUSE:Leap 15.5 | apache2-mod_jk | 0 | 1.2.49-150100.6.6.1 |
| openSUSE:Tumbleweed | apache2-mod_jk | 0 | 1.2.48-2.9 |
Related vulnerabilities
- CVE-2024-46544 Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local… Also affects libapache-mod-jk
- CVE-2023-41081 Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat… Also affects libapache-mod-jk
- CVE-2007-1860 mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs… Also affects libapache-mod-jk
- CVE-2007-0774 Stack-based buffer overflow in the map_uri_to_worker function… Also affects libapache-mod-jk
- CVE-2017-3737 OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. Also affects jbcs-httpd24-apache-commons-daemon-jsvc
- CVE-2017-3738 There is an overflow bug in the AVX2 Montgomery multiplication procedure used in… Also affects jbcs-httpd24-apache-commons-daemon-jsvc
- CVE-2017-3736 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL… Also affects jbcs-httpd24-apache-commons-daemon-jsvc
- CVE-2016-7055 There is a carry propagating bug in the Broadwell-specific Montgomery multiplication… Also affects jbcs-httpd24-apache-commons-daemon-jsvc