admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-07-11 16:13:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2023-09-24T22:00:24.793090+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2023-09-24 22:00:28 +00:00
parent f03b364235
commit 1d0d914182
2 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
CVE-2023/CVE-2023-410xx/CVE-2023-41081.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-41081", "id": "CVE-2023-41081",
"sourceIdentifier": "security@apache.org", "sourceIdentifier": "security@apache.org",
"published": "2023-09-13T10:15:07.657", "published": "2023-09-13T10:15:07.657",
"lastModified": "2023-09-15T13:26:15.493", "lastModified": "2023-09-24T20:15:11.013",
"vulnStatus": "Analyzed", "vulnStatus": "Modified",
"descriptions": [ "descriptions": [
{ {
"lang": "en", "lang": "en",
"value": "The mod_jk component of Apache Tomcat Connectors\u00a0in some circumstances, such as when a configuration included\u00a0\"JkOptions +ForwardDirectories\" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker.\u00a0Such an implicit mapping could result in the unintended exposure of the\u00a0status worker and/or bypass security constraints configured in httpd. As\u00a0of JK 1.2.49, the implicit mapping functionality has been removed and all\u00a0mappings must now be via explicit configuration.\u00a0Only mod_jk is affected\u00a0by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\n" "value": "The mod_jk component of Apache Tomcat Connectors\u00a0in some circumstances, such as when a configuration included\u00a0\"JkOptions +ForwardDirectories\" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker.\u00a0Such an implicit mapping could result in the unintended exposure of the\u00a0status worker and/or bypass security constraints configured in httpd. As\u00a0of JK 1.2.49, the implicit mapping functionality has been removed and all\u00a0mappings must now be via explicit configuration.\u00a0Only mod_jk is affected\u00a0by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\n"
},
{
"lang": "es",
"value": "El componente mod_jk de Apache Tomcat Connectors en algunas circunstancias, como cuando una configuraci\u00f3n inclu\u00eda \"JkOptions +ForwardDirectories\" pero la configuraci\u00f3n no proporcionaba montajes expl\u00edcitos para todas las posibles solicitudes de proxy, mod_jk usar\u00eda una asignaci\u00f3n impl\u00edcita y asignar\u00eda la solicitud a la primera solicitud definida trabajador. Un mapeo impl\u00edcito de este tipo podr\u00eda dar como resultado la exposici\u00f3n no deseada del estado del trabajador y/o eludir las restricciones de seguridad configuradas en httpd. A partir de JK 1.2.49, la funcionalidad de asignaci\u00f3n impl\u00edcita se elimin\u00f3 y todas las asignaciones ahora deben realizarse mediante una configuraci\u00f3n expl\u00edcita. S\u00f3lo mod_jk se ve afectado por este problema. El redirector ISAPI no se ve afectado. Este problema afecta a los conectores Apache Tomcat (solo mod_jk): desde 1.2.0 hasta 1.2.48. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.2.49, que soluciona el problema."
} }
], ],
"metrics": { "metrics": {
@ -80,6 +84,10 @@
"tags": [ "tags": [
"Mailing List" "Mailing List"
] ]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html",
"source": "security@apache.org"
} }
] ]
} }

13
README.md
View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update ### Last Repository Update
```plain ```plain
2023-09-24T02:00:24.779550+00:00 2023-09-24T22:00:24.793090+00:00
``` ```
### Most recent CVE Modification Timestamp synchronized with NVD ### Most recent CVE Modification Timestamp synchronized with NVD
```plain ```plain
2023-09-24T01:15:43.920000+00:00 2023-09-24T20:15:11.013000+00:00
``` ```
### Last Data Feed Release ### Last Data Feed Release
@ -34,18 +34,15 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### CVEs added in the last Commit ### CVEs added in the last Commit
Recently added CVEs: `4` Recently added CVEs: `0`
* [CVE-2023-1260](CVE-2023/CVE-2023-12xx/CVE-2023-1260.json) (`2023-09-24T01:15:42.707`)
* [CVE-2023-1625](CVE-2023/CVE-2023-16xx/CVE-2023-1625.json) (`2023-09-24T01:15:43.577`)
* [CVE-2023-1633](CVE-2023/CVE-2023-16xx/CVE-2023-1633.json) (`2023-09-24T01:15:43.760`)
* [CVE-2023-1636](CVE-2023/CVE-2023-16xx/CVE-2023-1636.json) (`2023-09-24T01:15:43.920`)
### CVEs modified in the last Commit ### CVEs modified in the last Commit
Recently modified CVEs: `0` Recently modified CVEs: `1`
* [CVE-2023-41081](CVE-2023/CVE-2023-410xx/CVE-2023-41081.json) (`2023-09-24T20:15:11.013`)
## Download and Usage ## Download and Usage