Apache Tomcat JK Connector: Information disclosure An error in the Apache Tomcat JK Connector might allow for an information disclosure flaw. mod_jk June 29, 2009 June 29, 2009: 01 265455 remote 1.2.27 1.2.27

The Apache Tomcat JK Connector (aka mod_jk) connects the Tomcat application server with the Apache HTTP Server.

The Red Hat Security Response Team discovered that mod_jk does not properly handle (1) requests setting the "Content-Length" header while not providing data and (2) clients sending repeated requests very quickly.

A remote attacker could send specially crafted requests or a large number of requests at a time, possibly resulting in the disclosure of a response intended for another client.

There is no known workaround at this time.

All Apache Tomcat JK Connector users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=www-apache/mod_jk-1.2.27" CVE-2008-5519 keytoaster a3li a3li