mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-07-09 16:05:11 +00:00
Auto-Update: 2023-09-24T22:00:24.793090+00:00
This commit is contained in:
parent
f03b364235
commit
1d0d914182
@ -2,12 +2,16 @@
|
|||||||
"id": "CVE-2023-41081",
|
"id": "CVE-2023-41081",
|
||||||
"sourceIdentifier": "security@apache.org",
|
"sourceIdentifier": "security@apache.org",
|
||||||
"published": "2023-09-13T10:15:07.657",
|
"published": "2023-09-13T10:15:07.657",
|
||||||
"lastModified": "2023-09-15T13:26:15.493",
|
"lastModified": "2023-09-24T20:15:11.013",
|
||||||
"vulnStatus": "Analyzed",
|
"vulnStatus": "Modified",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "The mod_jk component of Apache Tomcat Connectors\u00a0in some circumstances, such as when a configuration included\u00a0\"JkOptions +ForwardDirectories\" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker.\u00a0Such an implicit mapping could result in the unintended exposure of the\u00a0status worker and/or bypass security constraints configured in httpd. As\u00a0of JK 1.2.49, the implicit mapping functionality has been removed and all\u00a0mappings must now be via explicit configuration.\u00a0Only mod_jk is affected\u00a0by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\n"
|
"value": "The mod_jk component of Apache Tomcat Connectors\u00a0in some circumstances, such as when a configuration included\u00a0\"JkOptions +ForwardDirectories\" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker.\u00a0Such an implicit mapping could result in the unintended exposure of the\u00a0status worker and/or bypass security constraints configured in httpd. As\u00a0of JK 1.2.49, the implicit mapping functionality has been removed and all\u00a0mappings must now be via explicit configuration.\u00a0Only mod_jk is affected\u00a0by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\n"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "El componente mod_jk de Apache Tomcat Connectors en algunas circunstancias, como cuando una configuraci\u00f3n inclu\u00eda \"JkOptions +ForwardDirectories\" pero la configuraci\u00f3n no proporcionaba montajes expl\u00edcitos para todas las posibles solicitudes de proxy, mod_jk usar\u00eda una asignaci\u00f3n impl\u00edcita y asignar\u00eda la solicitud a la primera solicitud definida trabajador. Un mapeo impl\u00edcito de este tipo podr\u00eda dar como resultado la exposici\u00f3n no deseada del estado del trabajador y/o eludir las restricciones de seguridad configuradas en httpd. A partir de JK 1.2.49, la funcionalidad de asignaci\u00f3n impl\u00edcita se elimin\u00f3 y todas las asignaciones ahora deben realizarse mediante una configuraci\u00f3n expl\u00edcita. S\u00f3lo mod_jk se ve afectado por este problema. El redirector ISAPI no se ve afectado. Este problema afecta a los conectores Apache Tomcat (solo mod_jk): desde 1.2.0 hasta 1.2.48. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.2.49, que soluciona el problema."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
@ -80,6 +84,10 @@
|
|||||||
"tags": [
|
"tags": [
|
||||||
"Mailing List"
|
"Mailing List"
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html",
|
||||||
|
"source": "security@apache.org"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
13
README.md
13
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
|||||||
### Last Repository Update
|
### Last Repository Update
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
2023-09-24T02:00:24.779550+00:00
|
2023-09-24T22:00:24.793090+00:00
|
||||||
```
|
```
|
||||||
|
|
||||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
2023-09-24T01:15:43.920000+00:00
|
2023-09-24T20:15:11.013000+00:00
|
||||||
```
|
```
|
||||||
|
|
||||||
### Last Data Feed Release
|
### Last Data Feed Release
|
||||||
@ -34,18 +34,15 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
|||||||
|
|
||||||
### CVEs added in the last Commit
|
### CVEs added in the last Commit
|
||||||
|
|
||||||
Recently added CVEs: `4`
|
Recently added CVEs: `0`
|
||||||
|
|
||||||
* [CVE-2023-1260](CVE-2023/CVE-2023-12xx/CVE-2023-1260.json) (`2023-09-24T01:15:42.707`)
|
|
||||||
* [CVE-2023-1625](CVE-2023/CVE-2023-16xx/CVE-2023-1625.json) (`2023-09-24T01:15:43.577`)
|
|
||||||
* [CVE-2023-1633](CVE-2023/CVE-2023-16xx/CVE-2023-1633.json) (`2023-09-24T01:15:43.760`)
|
|
||||||
* [CVE-2023-1636](CVE-2023/CVE-2023-16xx/CVE-2023-1636.json) (`2023-09-24T01:15:43.920`)
|
|
||||||
|
|
||||||
|
|
||||||
### CVEs modified in the last Commit
|
### CVEs modified in the last Commit
|
||||||
|
|
||||||
Recently modified CVEs: `0`
|
Recently modified CVEs: `1`
|
||||||
|
|
||||||
|
* [CVE-2023-41081](CVE-2023/CVE-2023-410xx/CVE-2023-41081.json) (`2023-09-24T20:15:11.013`)
|
||||||
|
|
||||||
|
|
||||||
## Download and Usage
|
## Download and Usage
|
||||||
|
Loading…
x
Reference in New Issue
Block a user