CVE-2008-5519

Published: Apr 9, 2009Modified: Apr 23, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

Affected (128)

Products: Apache: Mod Jk, Tomcat

Apache

2 products

Mod Jk

Tomcat

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Apache Mod Jk	Version 1.2.10
Apache Mod Jk	Version 1.2.11
Apache Mod Jk	Version 1.2.12
Apache Mod Jk	Version 1.2.13
Apache Mod Jk	Version 1.2.14.1
Apache Mod Jk	Version 1.2.14
Apache Mod Jk	Version 1.2.15
Apache Mod Jk	Version 1.2.16
Apache Mod Jk	Version 1.2.17
Apache Mod Jk	Version 1.2.18
Apache Mod Jk	Version 1.2.19
Apache Mod Jk	Version 1.2.1
Apache Mod Jk	Version 1.2.20
Apache Mod Jk	Version 1.2.21
Apache Mod Jk	Version 1.2.22
Apache Mod Jk	Version 1.2.23
Apache Mod Jk	Version 1.2.24
Apache Mod Jk	Version 1.2.25
Apache Mod Jk	Version 1.2.26
Apache Mod Jk	Version 1.2.6
Apache Mod Jk	Version 1.2.7
Apache Mod Jk	Version 1.2.8
Apache Mod Jk	Version 1.2.9
Apache Mod Jk	Version 1.2

Configuration B

104 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 4.0.0
Apache Tomcat	Version 4.0.1
Apache Tomcat	Version 4.0.2
Apache Tomcat	Version 4.0.3
Apache Tomcat	Version 4.0.4
Apache Tomcat	Version 4.0.5
Apache Tomcat	Version 4.0.6
Apache Tomcat	Version 4.1.0
Apache Tomcat	Version 4.1.10
Apache Tomcat	Version 4.1.11
Apache Tomcat	Version 4.1.12
Apache Tomcat	Version 4.1.13
Apache Tomcat	Version 4.1.14
Apache Tomcat	Version 4.1.15
Apache Tomcat	Version 4.1.16
Apache Tomcat	Version 4.1.17
Apache Tomcat	Version 4.1.18
Apache Tomcat	Version 4.1.19
Apache Tomcat	Version 4.1.1
Apache Tomcat	Version 4.1.20
Apache Tomcat	Version 4.1.21
Apache Tomcat	Version 4.1.22
Apache Tomcat	Version 4.1.23
Apache Tomcat	Version 4.1.24
Apache Tomcat	Version 4.1.25
Apache Tomcat	Version 4.1.26
Apache Tomcat	Version 4.1.27
Apache Tomcat	Version 4.1.28
Apache Tomcat	Version 4.1.29
Apache Tomcat	Version 4.1.2
Apache Tomcat	Version 4.1.30
Apache Tomcat	Version 4.1.31
Apache Tomcat	Version 4.1.32
Apache Tomcat	Version 4.1.33
Apache Tomcat	Version 4.1.34
Apache Tomcat	Version 4.1.35
Apache Tomcat	Version 4.1.36
Apache Tomcat	Version 4.1.3
Apache Tomcat	Version 4.1.3 beta
Apache Tomcat	Version 4.1.4
Apache Tomcat	Version 4.1.5
Apache Tomcat	Version 4.1.6
Apache Tomcat	Version 4.1.7
Apache Tomcat	Version 4.1.8
Apache Tomcat	Version 4.1.9
Apache Tomcat	Version 4.1.9 beta
Apache Tomcat	Version 5.0.0
Apache Tomcat	Version 5.0.10
Apache Tomcat	Version 5.0.11
Apache Tomcat	Version 5.0.12
Apache Tomcat	Version 5.0.13
Apache Tomcat	Version 5.0.14
Apache Tomcat	Version 5.0.15
Apache Tomcat	Version 5.0.16
Apache Tomcat	Version 5.0.17
Apache Tomcat	Version 5.0.18
Apache Tomcat	Version 5.0.19
Apache Tomcat	Version 5.0.1
Apache Tomcat	Version 5.0.21
Apache Tomcat	Version 5.0.22
Apache Tomcat	Version 5.0.23
Apache Tomcat	Version 5.0.24
Apache Tomcat	Version 5.0.25
Apache Tomcat	Version 5.0.26
Apache Tomcat	Version 5.0.27
Apache Tomcat	Version 5.0.28
Apache Tomcat	Version 5.0.29
Apache Tomcat	Version 5.0.2
Apache Tomcat	Version 5.0.30
Apache Tomcat	Version 5.0.3
Apache Tomcat	Version 5.0.4
Apache Tomcat	Version 5.0.5
Apache Tomcat	Version 5.0.6
Apache Tomcat	Version 5.0.7
Apache Tomcat	Version 5.0.8
Apache Tomcat	Version 5.0.9
Apache Tomcat	Version 5.5.0
Apache Tomcat	Version 5.5.10
Apache Tomcat	Version 5.5.11
Apache Tomcat	Version 5.5.12
Apache Tomcat	Version 5.5.13
Apache Tomcat	Version 5.5.14
Apache Tomcat	Version 5.5.15
Apache Tomcat	Version 5.5.16
Apache Tomcat	Version 5.5.17
Apache Tomcat	Version 5.5.18
Apache Tomcat	Version 5.5.19
Apache Tomcat	Version 5.5.1
Apache Tomcat	Version 5.5.20
Apache Tomcat	Version 5.5.21
Apache Tomcat	Version 5.5.22
Apache Tomcat	Version 5.5.23
Apache Tomcat	Version 5.5.24
Apache Tomcat	Version 5.5.25
Apache Tomcat	Version 5.5.26
Apache Tomcat	Version 5.5.27
Apache Tomcat	Version 5.5.2
Apache Tomcat	Version 5.5.3
Apache Tomcat	Version 5.5.4
Apache Tomcat	Version 5.5.5
Apache Tomcat	Version 5.5.6
Apache Tomcat	Version 5.5.7
Apache Tomcat	Version 5.5.8
Apache Tomcat	Version 5.5.9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (52)

http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/www-announce/200904.mbox/%3C49DBBAC0.2080400%40apache.org%3E

Source: secalert@redhat.com

http://marc.info/?l=tomcat-dev&m=123913700700879

Source: secalert@redhat.com

http://secunia.com/advisories/29283

Source: secalert@redhat.com

http://secunia.com/advisories/34621

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35537

Source: secalert@redhat.com

http://securitytracker.com/id?1022001

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-262468-1

Source: secalert@redhat.com

http://svn.eu.apache.org/viewvc/tomcat/connectors/trunk/jk/native/common/jk_ajp_common.c?r1=702387&r2=702540&pathrev=702540&diff_format=h

Source: secalert@redhat.com

Vendor Advisory

http://svn.eu.apache.org/viewvc/tomcat/connectors/trunk/jk/xdocs/miscellaneous/changelog.xml?view=markup&pathrev=702540

Source: secalert@redhat.com

ExploitVendor Advisory

http://svn.eu.apache.org/viewvc?view=rev&revision=702540

Source: secalert@redhat.com

Vendor Advisory

http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html

Source: secalert@redhat.com

Vendor Advisory

http://tomcat.apache.org/security-jk.html

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2009/dsa-1810

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2009/04/08/10

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-0446.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/502530/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/34412

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0973

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=490201

Source: secalert@redhat.com

Vendor Advisory

https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html