diff --git a/CVE-2023/CVE-2023-410xx/CVE-2023-41081.json b/CVE-2023/CVE-2023-410xx/CVE-2023-41081.json index 8f920a39243..2f941d6c045 100644 --- a/CVE-2023/CVE-2023-410xx/CVE-2023-41081.json +++ b/CVE-2023/CVE-2023-410xx/CVE-2023-41081.json @@ -2,12 +2,16 @@ "id": "CVE-2023-41081", "sourceIdentifier": "security@apache.org", "published": "2023-09-13T10:15:07.657", - "lastModified": "2023-09-15T13:26:15.493", - "vulnStatus": "Analyzed", + "lastModified": "2023-09-24T20:15:11.013", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", "value": "The mod_jk component of Apache Tomcat Connectors\u00a0in some circumstances, such as when a configuration included\u00a0\"JkOptions +ForwardDirectories\" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker.\u00a0Such an implicit mapping could result in the unintended exposure of the\u00a0status worker and/or bypass security constraints configured in httpd. As\u00a0of JK 1.2.49, the implicit mapping functionality has been removed and all\u00a0mappings must now be via explicit configuration.\u00a0Only mod_jk is affected\u00a0by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\n" + }, + { + "lang": "es", + "value": "El componente mod_jk de Apache Tomcat Connectors en algunas circunstancias, como cuando una configuraci\u00f3n inclu\u00eda \"JkOptions +ForwardDirectories\" pero la configuraci\u00f3n no proporcionaba montajes expl\u00edcitos para todas las posibles solicitudes de proxy, mod_jk usar\u00eda una asignaci\u00f3n impl\u00edcita y asignar\u00eda la solicitud a la primera solicitud definida trabajador. Un mapeo impl\u00edcito de este tipo podr\u00eda dar como resultado la exposici\u00f3n no deseada del estado del trabajador y/o eludir las restricciones de seguridad configuradas en httpd. A partir de JK 1.2.49, la funcionalidad de asignaci\u00f3n impl\u00edcita se elimin\u00f3 y todas las asignaciones ahora deben realizarse mediante una configuraci\u00f3n expl\u00edcita. S\u00f3lo mod_jk se ve afectado por este problema. El redirector ISAPI no se ve afectado. Este problema afecta a los conectores Apache Tomcat (solo mod_jk): desde 1.2.0 hasta 1.2.48. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.2.49, que soluciona el problema." } ], "metrics": { @@ -80,6 +84,10 @@ "tags": [ "Mailing List" ] + }, + { + "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html", + "source": "security@apache.org" } ] } \ No newline at end of file diff --git a/README.md b/README.md index 5e15e42d171..74d23eb5ab8 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-09-24T02:00:24.779550+00:00 +2023-09-24T22:00:24.793090+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-09-24T01:15:43.920000+00:00 +2023-09-24T20:15:11.013000+00:00 ``` ### Last Data Feed Release @@ -34,18 +34,15 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### CVEs added in the last Commit -Recently added CVEs: `4` +Recently added CVEs: `0` -* [CVE-2023-1260](CVE-2023/CVE-2023-12xx/CVE-2023-1260.json) (`2023-09-24T01:15:42.707`) -* [CVE-2023-1625](CVE-2023/CVE-2023-16xx/CVE-2023-1625.json) (`2023-09-24T01:15:43.577`) -* [CVE-2023-1633](CVE-2023/CVE-2023-16xx/CVE-2023-1633.json) (`2023-09-24T01:15:43.760`) -* [CVE-2023-1636](CVE-2023/CVE-2023-16xx/CVE-2023-1636.json) (`2023-09-24T01:15:43.920`) ### CVEs modified in the last Commit -Recently modified CVEs: `0` +Recently modified CVEs: `1` +* [CVE-2023-41081](CVE-2023/CVE-2023-410xx/CVE-2023-41081.json) (`2023-09-24T20:15:11.013`) ## Download and Usage