Red Hat Security Advisory

RHSA-2024:2387

mod_jk and mod_proxy_cluster security update

Released 2024-04-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) mod_jk-1.2.49-1.el9_4, mod_proxy_cluster-1.3.20-1.el9_4

Fixes 2 records

TI-2023-21705 CVE-2023-41081 · GHSA-4wvr-fq5p-2362

Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request

MEDIUM 42

Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01589 Published 2023-09-13 Partial fix

TI-2023-06137 CVE-2023-6710 · GHSA-5xpv-wgx6-ggmv

Mod_cluster/mod_proxy_cluster: stored cross site scripting

LOW 29

A flaw was found in the mod_proxy_cluster in the Apache server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02242 Published 2023-12-12 Partial fix · 1.3.20-3.el8jbcs, 1.3.20-3.el7jbcs +1 CWE-79