libapache2-mod-jk: [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk

Debian Bug report logs - #523054
libapache2-mod-jk: [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Damien Raude-Morvan" <drazzib@drazzib.com>

To: submit@bugs.debian.org

Subject: libapache2-mod-jk: [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk

Date: Wed, 8 Apr 2009 09:19:00 +0200 (CEST)

[Message part 1 (text/plain, inline)]

Package: libapache2-mod-jk
Version: 1:1.2.26-2
Severity: grave
Tags: security
Justification: user security hole

The Apache Tomcat Security Team has released the following advisory :

  Vulnerability announcement:
  CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability

  Severity: important

  Vendor: The Apache Software Foundation

  Versions Affected:
  mod_jk 1.2.0 to 1.2.26

  Description:
  Situations where faulty clients set Content-Length without providing
  data, or where a user submits repeated requests very quickly may permit
  one user to view the response associated with a different user's request.

  Mitigation:
  Upgrade to mod_jk 1.2.27 or later

  Example:
  See description

  Credit:
  This issue was discovered by the Red Hat Security Response Team

  References:
  http://tomcat.apache.org/security.html
  http://tomcat.apache.org/security-jk.html

-- 
Damien Raude-Morvan

[signature.asc (application/pgp-signature, attachment)]

Message #10 received at 523054@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: team@security.debian.org, 523054@bugs.debian.org

Cc: debian-security@lists.debian.org

Subject: Any likely update for mod_jk?

Date: Tue, 12 May 2009 13:54:10 +0100

Hi,

I wondered if any fix is likely to be available for CVE-2008-5519
(information disclosure, looks potentially quite severe) any time
soon or if any more help is needed?

Cheers,
Dominic.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Message #15 received at 523054@bugs.debian.org (full text, mbox, reply):

From: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>

To: Dominic Hargreaves <dom@earth.li>

Cc: team@security.debian.org, 523054@bugs.debian.org, debian-security@lists.debian.org

Subject: Re: Any likely update for mod_jk?

Date: Thu, 14 May 2009 10:34:04 -0400

On Tue, 12 May 2009 13:54:10 +0100, Dominic Hargreaves wrote:
> Hi,
> 
> I wondered if any fix is likely to be available for CVE-2008-5519
> (information disclosure, looks potentially quite severe) any time
> soon or if any more help is needed?

hi,

no one has claimed this (that i've seen), and the maintainer has not yet
responded, so if you are able to help, please do so.  let the security
team and maintainer know if you are going to work this so that there
isn't duplicated work.

mike

Message #20 received at 523054@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@debian.org>

To: 523054@bugs.debian.org

Subject: NMU

Date: Sat, 30 May 2009 15:56:40 +0200

[Message part 1 (text/plain, inline)]

I am going to upload a NMU for this issue. Patch attached.

[Message part 2 (text/html, inline)]

[diff (text/x-patch, attachment)]

Message #25 received at 523054-close@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@debian.org>

To: 523054-close@bugs.debian.org

Subject: Bug#523054: fixed in libapache-mod-jk 1:1.2.26-2.1

Date: Sat, 30 May 2009 15:33:42 +0000

Source: libapache-mod-jk
Source-Version: 1:1.2.26-2.1

We believe that the bug you reported is fixed in the latest version of
libapache-mod-jk, which is due to be installed in the Debian FTP archive:

libapache-mod-jk-doc_1.2.26-2.1_all.deb
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk-doc_1.2.26-2.1_all.deb
libapache-mod-jk_1.2.26-2.1.diff.gz
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.26-2.1.diff.gz
libapache-mod-jk_1.2.26-2.1.dsc
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.26-2.1.dsc
libapache2-mod-jk_1.2.26-2.1_i386.deb
  to pool/main/liba/libapache-mod-jk/libapache2-mod-jk_1.2.26-2.1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 523054@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefan Fritsch <sf@debian.org> (supplier of updated libapache-mod-jk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sat, 30 May 2009 15:49:20 +0200
Source: libapache-mod-jk
Binary: libapache2-mod-jk libapache-mod-jk-doc
Architecture: source i386 all
Version: 1:1.2.26-2.1
Distribution: unstable
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Stefan Fritsch <sf@debian.org>
Description: 
 libapache-mod-jk-doc - Documentation of libapache2-mod-jk package
 libapache2-mod-jk - Apache 2 connector for the Tomcat Java servlet engine
Closes: 523054
Changes: 
 libapache-mod-jk (1:1.2.26-2.1) unstable; urgency=high
 .
   * Non-maintainer upload by the security-team.
   * CVE-2008-5519: Fix information disclosure vulnerability when clients
     abort connection before sending POST body (closes: #523054).
Checksums-Sha1: 
 4c90427862aed848218116355a89d2a39026dd14 1316 libapache-mod-jk_1.2.26-2.1.dsc
 6418f610c7b673e980d55add2182adb4462920ed 12303 libapache-mod-jk_1.2.26-2.1.diff.gz
 6c121b29a6342c731815862c00fa537e1e184960 109712 libapache2-mod-jk_1.2.26-2.1_i386.deb
 26d266d05adc28b977922b149020c643c1fd3c8a 174676 libapache-mod-jk-doc_1.2.26-2.1_all.deb
Checksums-Sha256: 
 3e27e26f7818bad7d2a77d494131525bd8f1bd6034ba8d700207382c0c7d25d1 1316 libapache-mod-jk_1.2.26-2.1.dsc
 b0a7849da9bdbbd9dce80555e53d216ad44cf933961404b67dd28a8c2b3afd01 12303 libapache-mod-jk_1.2.26-2.1.diff.gz
 38194e2f73355397818f9bbb70932cccbe441285f3accd1f808ad3f96581b032 109712 libapache2-mod-jk_1.2.26-2.1_i386.deb
 74f191cee92519b7ff13cb661c8b3b37572c4e69d418743b6c1928e7b76ca03c 174676 libapache-mod-jk-doc_1.2.26-2.1_all.deb
Files: 
 517d6349b997afd1a23999a5e76dbd51 1316 web optional libapache-mod-jk_1.2.26-2.1.dsc
 f8ef641c2b6e349afcecabb9533369a1 12303 web optional libapache-mod-jk_1.2.26-2.1.diff.gz
 081f3cda134c3064cdecd818f73ec150 109712 web optional libapache2-mod-jk_1.2.26-2.1_i386.deb
 eb1db795a63b188a72fd253eebb2fd3e 174676 doc optional libapache-mod-jk-doc_1.2.26-2.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKITzSbxelr8HyTqQRAgRAAJ41tGkz+998h5r3Ph9fvQ4VCmUbOQCglLbj
PPJVLoPaCkwusWUqOuA7AKw=
=GS3F
-----END PGP SIGNATURE-----

Message #30 received at 523054-close@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@debian.org>

To: 523054-close@bugs.debian.org

Subject: Bug#523054: fixed in libapache-mod-jk 1:1.2.26-2+lenny1

Date: Thu, 11 Jun 2009 07:54:07 +0000

Source: libapache-mod-jk
Source-Version: 1:1.2.26-2+lenny1

We believe that the bug you reported is fixed in the latest version of
libapache-mod-jk, which is due to be installed in the Debian FTP archive:

libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
libapache-mod-jk_1.2.26-2+lenny1.diff.gz
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.26-2+lenny1.diff.gz
libapache-mod-jk_1.2.26-2+lenny1.dsc
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.26-2+lenny1.dsc
libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
  to pool/main/liba/libapache-mod-jk/libapache2-mod-jk_1.2.26-2+lenny1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 523054@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefan Fritsch <sf@debian.org> (supplier of updated libapache-mod-jk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 31 May 2009 20:33:52 +0200
Source: libapache-mod-jk
Binary: libapache2-mod-jk libapache-mod-jk-doc
Architecture: source i386 all
Version: 1:1.2.26-2+lenny1
Distribution: stable-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Stefan Fritsch <sf@debian.org>
Description: 
 libapache-mod-jk-doc - Documentation of libapache2-mod-jk package
 libapache2-mod-jk - Apache 2 connector for the Tomcat Java servlet engine
Closes: 523054
Changes: 
 libapache-mod-jk (1:1.2.26-2+lenny1) stable-security; urgency=high
 .
   * Non-maintainer upload by the security-team.
   * CVE-2008-5519: Fix information disclosure vulnerability when clients
     abort connection before sending POST body (closes: #523054).
Checksums-Sha1: 
 a13a270b5dc2af1382b3fe30fa3452706984a195 1336 libapache-mod-jk_1.2.26-2+lenny1.dsc
 e0eacd0c86b25b4f97181b77c73865143a93124f 12187 libapache-mod-jk_1.2.26-2+lenny1.diff.gz
 c4a1bef1c13d6253c2c3f6d86aebe0b1f288e0e0 109874 libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
 de0d7a8b1bc59a9c08d153d90dbd11662ac04448 169998 libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
 08d577fd517283182bf1ef491ab31ed1fe5fa0fe 1442605 libapache-mod-jk_1.2.26.orig.tar.gz
Checksums-Sha256: 
 22145f0736fe73f22ed8a5611f417d82dccdf3e7e8ca4ded2330983b42da387f 1336 libapache-mod-jk_1.2.26-2+lenny1.dsc
 a5a555170c1539983e1a8e73f421606815af67916ea98f73eff77dbf321b96ab 12187 libapache-mod-jk_1.2.26-2+lenny1.diff.gz
 2bb9e40b30f42f8202486812f73123637632a25ae8351d2ee1eee1b94d69a80f 109874 libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
 803637f7c7ac6c7bd6eaa4aeb9ec455b50d1bfe169bd899ad4f95d6a862df574 169998 libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
 75c2ef701622394536be2e0a2e5cf38330e8bb1078d683a733769a8c49a5381a 1442605 libapache-mod-jk_1.2.26.orig.tar.gz
Files: 
 7070da05cbe8200e7d92dbfe9228ab0e 1336 web optional libapache-mod-jk_1.2.26-2+lenny1.dsc
 8b6e6b0abd76bae90c99c50ab1fee027 12187 web optional libapache-mod-jk_1.2.26-2+lenny1.diff.gz
 bf54bb8f3489715932e5a07739a63dc4 109874 web optional libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
 d31f4efe7b78e94bf1c7cffabce17c6b 169998 doc optional libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
 feaec245136bc4d99a9dde95a00ea93c 1442605 web optional libapache-mod-jk_1.2.26.orig.tar.gz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKIuT1bxelr8HyTqQRAjQCAJ9YZjFlq8QLidjlI3f3JxDM5l9YpACg0lrf
KH83Gor8WxQVmRgfTBKokHo=
=syoX
-----END PGP SIGNATURE-----

Message #35 received at 523054-close@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@debian.org>

To: 523054-close@bugs.debian.org

Subject: Bug#523054: fixed in libapache-mod-jk 1:1.2.26-2+lenny1

Date: Sat, 27 Jun 2009 16:04:31 +0000

Source: libapache-mod-jk
Source-Version: 1:1.2.26-2+lenny1

We believe that the bug you reported is fixed in the latest version of
libapache-mod-jk, which is due to be installed in the Debian FTP archive:

libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
libapache-mod-jk_1.2.26-2+lenny1.diff.gz
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.26-2+lenny1.diff.gz
libapache-mod-jk_1.2.26-2+lenny1.dsc
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.26-2+lenny1.dsc
libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
  to pool/main/liba/libapache-mod-jk/libapache2-mod-jk_1.2.26-2+lenny1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 523054@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefan Fritsch <sf@debian.org> (supplier of updated libapache-mod-jk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 31 May 2009 20:33:52 +0200
Source: libapache-mod-jk
Binary: libapache2-mod-jk libapache-mod-jk-doc
Architecture: source i386 all
Version: 1:1.2.26-2+lenny1
Distribution: stable-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Stefan Fritsch <sf@debian.org>
Description: 
 libapache-mod-jk-doc - Documentation of libapache2-mod-jk package
 libapache2-mod-jk - Apache 2 connector for the Tomcat Java servlet engine
Closes: 523054
Changes: 
 libapache-mod-jk (1:1.2.26-2+lenny1) stable-security; urgency=high
 .
   * Non-maintainer upload by the security-team.
   * CVE-2008-5519: Fix information disclosure vulnerability when clients
     abort connection before sending POST body (closes: #523054).
Checksums-Sha1: 
 a13a270b5dc2af1382b3fe30fa3452706984a195 1336 libapache-mod-jk_1.2.26-2+lenny1.dsc
 e0eacd0c86b25b4f97181b77c73865143a93124f 12187 libapache-mod-jk_1.2.26-2+lenny1.diff.gz
 c4a1bef1c13d6253c2c3f6d86aebe0b1f288e0e0 109874 libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
 de0d7a8b1bc59a9c08d153d90dbd11662ac04448 169998 libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
 08d577fd517283182bf1ef491ab31ed1fe5fa0fe 1442605 libapache-mod-jk_1.2.26.orig.tar.gz
Checksums-Sha256: 
 22145f0736fe73f22ed8a5611f417d82dccdf3e7e8ca4ded2330983b42da387f 1336 libapache-mod-jk_1.2.26-2+lenny1.dsc
 a5a555170c1539983e1a8e73f421606815af67916ea98f73eff77dbf321b96ab 12187 libapache-mod-jk_1.2.26-2+lenny1.diff.gz
 2bb9e40b30f42f8202486812f73123637632a25ae8351d2ee1eee1b94d69a80f 109874 libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
 803637f7c7ac6c7bd6eaa4aeb9ec455b50d1bfe169bd899ad4f95d6a862df574 169998 libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
 75c2ef701622394536be2e0a2e5cf38330e8bb1078d683a733769a8c49a5381a 1442605 libapache-mod-jk_1.2.26.orig.tar.gz
Files: 
 7070da05cbe8200e7d92dbfe9228ab0e 1336 web optional libapache-mod-jk_1.2.26-2+lenny1.dsc
 8b6e6b0abd76bae90c99c50ab1fee027 12187 web optional libapache-mod-jk_1.2.26-2+lenny1.diff.gz
 bf54bb8f3489715932e5a07739a63dc4 109874 web optional libapache2-mod-jk_1.2.26-2+lenny1_i386.deb
 d31f4efe7b78e94bf1c7cffabce17c6b 169998 doc optional libapache-mod-jk-doc_1.2.26-2+lenny1_all.deb
 feaec245136bc4d99a9dde95a00ea93c 1442605 web optional libapache-mod-jk_1.2.26.orig.tar.gz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKIuT1bxelr8HyTqQRAjQCAJ9YZjFlq8QLidjlI3f3JxDM5l9YpACg0lrf
KH83Gor8WxQVmRgfTBKokHo=
=syoX
-----END PGP SIGNATURE-----

Message #40 received at 523054-close@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@debian.org>

To: 523054-close@bugs.debian.org

Subject: Bug#523054: fixed in libapache-mod-jk 1:1.2.18-3etch4

Date: Fri, 03 Jul 2009 19:54:31 +0000

Source: libapache-mod-jk
Source-Version: 1:1.2.18-3etch4

We believe that the bug you reported is fixed in the latest version of
libapache-mod-jk, which is due to be installed in the Debian FTP archive:

libapache-mod-jk-doc_1.2.18-3etch4_all.deb
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk-doc_1.2.18-3etch4_all.deb
libapache-mod-jk_1.2.18-3etch4.diff.gz
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.18-3etch4.diff.gz
libapache-mod-jk_1.2.18-3etch4.dsc
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.18-3etch4.dsc
libapache-mod-jk_1.2.18-3etch4_i386.deb
  to pool/main/liba/libapache-mod-jk/libapache-mod-jk_1.2.18-3etch4_i386.deb
libapache2-mod-jk_1.2.18-3etch4_i386.deb
  to pool/main/liba/libapache-mod-jk/libapache2-mod-jk_1.2.18-3etch4_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 523054@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefan Fritsch <sf@debian.org> (supplier of updated libapache-mod-jk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 30 May 2009 21:18:12 +0200
Source: libapache-mod-jk
Binary: libapache-mod-jk libapache2-mod-jk libapache-mod-jk-doc
Architecture: source all i386
Version: 1:1.2.18-3etch4
Distribution: oldstable-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Stefan Fritsch <sf@debian.org>
Description: 
 libapache-mod-jk - Apache 1.3 connector for the Tomcat Java servlet engine
 libapache-mod-jk-doc - Documentation of libapache-mod-jk/libapache2-mod-jk packages
 libapache2-mod-jk - Apache 2 connector for the Tomcat Java servlet engine
Closes: 523054
Changes: 
 libapache-mod-jk (1:1.2.18-3etch4) oldstable-security; urgency=high
 .
   * Non-maintainer upload by the security-team.
   * CVE-2008-5519: Fix information disclosure vulnerability when clients
     abort connection before sending POST body (closes: #523054).
Files: 
 dc3dd860d8c7a2710943903b485b1afa 935 web optional libapache-mod-jk_1.2.18-3etch4.dsc
 889ac12a51c93772cefad6af5225f7f7 11556 web optional libapache-mod-jk_1.2.18-3etch4.diff.gz
 028881fdbf37c27de6fa3edd8fbd05c4 89482 web optional libapache-mod-jk_1.2.18-3etch4_i386.deb
 92d553ae68620971f9b81d81400cc7aa 93386 web optional libapache2-mod-jk_1.2.18-3etch4_i386.deb
 04190ed8b2fc8fea1bf98b1b1df14e9b 118140 doc optional libapache-mod-jk-doc_1.2.18-3etch4_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKIuMlbxelr8HyTqQRAo1aAKCBeMxrd5Z+tYSmX/r77a6OwgvXJwCgrQRW
ACdEG4o/KSqFFtWEk5fpT/o=
=GfaC
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.