CVE-2008-5519 The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances...
LowCVSS 2.6
EPSS 7.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache mod jk | = 1.2 | No fix listed |
| apache mod jk | = 1.2.1 | No fix listed |
| apache mod jk | = 1.2.6 | No fix listed |
| apache mod jk | = 1.2.7 | No fix listed |
| apache mod jk | = 1.2.8 | No fix listed |
| apache mod jk | = 1.2.9 | No fix listed |
| apache mod jk | = 1.2.10 | No fix listed |
| apache mod jk | = 1.2.11 | No fix listed |
| apache mod jk | = 1.2.12 | No fix listed |
| apache mod jk | = 1.2.13 | No fix listed |
| apache mod jk | = 1.2.14 | No fix listed |
| apache mod jk | = 1.2.14.1 | No fix listed |
| apache mod jk | = 1.2.15 | No fix listed |
| apache mod jk | = 1.2.16 | No fix listed |
| apache mod jk | = 1.2.17 | No fix listed |
| apache mod jk | = 1.2.18 | No fix listed |
| apache mod jk | = 1.2.19 | No fix listed |
| apache mod jk | = 1.2.20 | No fix listed |
| apache mod jk | = 1.2.21 | No fix listed |
| apache mod jk | = 1.2.22 | No fix listed |
| apache mod jk | = 1.2.23 | No fix listed |
| apache mod jk | = 1.2.24 | No fix listed |
| apache mod jk | = 1.2.25 | No fix listed |
| apache mod jk | = 1.2.26 | No fix listed |
| apache tomcat | = 4.0.0 | No fix listed |
Show 106 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | = 4.0.1 | No fix listed |
| apache tomcat | = 4.0.2 | No fix listed |
| apache tomcat | = 4.0.3 | No fix listed |
| apache tomcat | = 4.0.4 | No fix listed |
| apache tomcat | = 4.0.5 | No fix listed |
| apache tomcat | = 4.0.6 | No fix listed |
| apache tomcat | = 4.1.0 | No fix listed |
| apache tomcat | = 4.1.1 | No fix listed |
| apache tomcat | = 4.1.2 | No fix listed |
| apache tomcat | = 4.1.3 | No fix listed |
| apache tomcat | = 4.1.3-beta | No fix listed |
| apache tomcat | = 4.1.4 | No fix listed |
| apache tomcat | = 4.1.5 | No fix listed |
| apache tomcat | = 4.1.6 | No fix listed |
| apache tomcat | = 4.1.7 | No fix listed |
| apache tomcat | = 4.1.8 | No fix listed |
| apache tomcat | = 4.1.9 | No fix listed |
| apache tomcat | = 4.1.9-beta | No fix listed |
| apache tomcat | = 4.1.10 | No fix listed |
| apache tomcat | = 4.1.11 | No fix listed |
| apache tomcat | = 4.1.12 | No fix listed |
| apache tomcat | = 4.1.13 | No fix listed |
| apache tomcat | = 4.1.14 | No fix listed |
| apache tomcat | = 4.1.15 | No fix listed |
| apache tomcat | = 4.1.16 | No fix listed |
| apache tomcat | = 4.1.17 | No fix listed |
| apache tomcat | = 4.1.18 | No fix listed |
| apache tomcat | = 4.1.19 | No fix listed |
| apache tomcat | = 4.1.20 | No fix listed |
| apache tomcat | = 4.1.21 | No fix listed |
| apache tomcat | = 4.1.22 | No fix listed |
| apache tomcat | = 4.1.23 | No fix listed |
| apache tomcat | = 4.1.24 | No fix listed |
| apache tomcat | = 4.1.25 | No fix listed |
| apache tomcat | = 4.1.26 | No fix listed |
| apache tomcat | = 4.1.27 | No fix listed |
| apache tomcat | = 4.1.28 | No fix listed |
| apache tomcat | = 4.1.29 | No fix listed |
| apache tomcat | = 4.1.30 | No fix listed |
| apache tomcat | = 4.1.31 | No fix listed |
| apache tomcat | = 4.1.32 | No fix listed |
| apache tomcat | = 4.1.33 | No fix listed |
| apache tomcat | = 4.1.34 | No fix listed |
| apache tomcat | = 4.1.35 | No fix listed |
| apache tomcat | = 4.1.36 | No fix listed |
| apache tomcat | = 5.0.0 | No fix listed |
| apache tomcat | = 5.0.1 | No fix listed |
| apache tomcat | = 5.0.2 | No fix listed |
| apache tomcat | = 5.0.3 | No fix listed |
| apache tomcat | = 5.0.4 | No fix listed |
| apache tomcat | = 5.0.5 | No fix listed |
| apache tomcat | = 5.0.6 | No fix listed |
| apache tomcat | = 5.0.7 | No fix listed |
| apache tomcat | = 5.0.8 | No fix listed |
| apache tomcat | = 5.0.9 | No fix listed |
| apache tomcat | = 5.0.10 | No fix listed |
| apache tomcat | = 5.0.11 | No fix listed |
| apache tomcat | = 5.0.12 | No fix listed |
| apache tomcat | = 5.0.13 | No fix listed |
| apache tomcat | = 5.0.14 | No fix listed |
| apache tomcat | = 5.0.15 | No fix listed |
| apache tomcat | = 5.0.16 | No fix listed |
| apache tomcat | = 5.0.17 | No fix listed |
| apache tomcat | = 5.0.18 | No fix listed |
| apache tomcat | = 5.0.19 | No fix listed |
| apache tomcat | = 5.0.21 | No fix listed |
| apache tomcat | = 5.0.22 | No fix listed |
| apache tomcat | = 5.0.23 | No fix listed |
| apache tomcat | = 5.0.24 | No fix listed |
| apache tomcat | = 5.0.25 | No fix listed |
| apache tomcat | = 5.0.26 | No fix listed |
| apache tomcat | = 5.0.27 | No fix listed |
| apache tomcat | = 5.0.28 | No fix listed |
| apache tomcat | = 5.0.29 | No fix listed |
| apache tomcat | = 5.0.30 | No fix listed |
| apache tomcat | = 5.5.0 | No fix listed |
| apache tomcat | = 5.5.1 | No fix listed |
| apache tomcat | = 5.5.2 | No fix listed |
| apache tomcat | = 5.5.3 | No fix listed |
| apache tomcat | = 5.5.4 | No fix listed |
| apache tomcat | = 5.5.5 | No fix listed |
| apache tomcat | = 5.5.6 | No fix listed |
| apache tomcat | = 5.5.7 | No fix listed |
| apache tomcat | = 5.5.8 | No fix listed |
| apache tomcat | = 5.5.9 | No fix listed |
| apache tomcat | = 5.5.10 | No fix listed |
| apache tomcat | = 5.5.11 | No fix listed |
| apache tomcat | = 5.5.12 | No fix listed |
| apache tomcat | = 5.5.13 | No fix listed |
| apache tomcat | = 5.5.14 | No fix listed |
| apache tomcat | = 5.5.15 | No fix listed |
| apache tomcat | = 5.5.16 | No fix listed |
| apache tomcat | = 5.5.17 | No fix listed |
| apache tomcat | = 5.5.18 | No fix listed |
| apache tomcat | = 5.5.19 | No fix listed |
| apache tomcat | = 5.5.20 | No fix listed |
| apache tomcat | = 5.5.21 | No fix listed |
| apache tomcat | = 5.5.22 | No fix listed |
| apache tomcat | = 5.5.23 | No fix listed |
| apache tomcat | = 5.5.24 | No fix listed |
| apache tomcat | = 5.5.25 | No fix listed |
| apache tomcat | = 5.5.26 | No fix listed |
| apache tomcat | = 5.5.27 | No fix listed |
| debian/libapache-mod-jk(Debian:12) | < 1:1.2.26-2.1 | 1:1.2.26-2.1 |
| debian/libapache-mod-jk(Debian:13) | < 1:1.2.26-2.1 | 1:1.2.26-2.1 |
| debian/libapache-mod-jk(Debian:14) | < 1:1.2.26-2.1 | 1:1.2.26-2.1 |
References
- SUSE-SR:2009:018 vendor-advisory
- [www-announce] 20090407 [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability mailing-list
- [tomcat-dev] 20090407 [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability mailing-list
- 29283 third-party-advisory
- 34621 third-party-advisory vendor-advisory
- 35537 third-party-advisory
- 1022001 vdb-entry
- 262468 vendor-advisory
- svn.eu.apache.org vendor-advisory
- svn.eu.apache.org exploit vendor-advisory
- svn.eu.apache.org vendor-advisory
- tomcat.apache.org vendor-advisory
- tomcat.apache.org vendor-advisory
- DSA-1810 vendor-advisory
- [oss-security] 20090408 CVE-2008-5519: mod_jk session information leak vulnerability mailing-list
- RHSA-2009:0446 vendor-advisory
- 20090407 [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability mailing-list
- 34412 vdb-entry
- ADV-2009-0973 vdb-entry
- bugzilla.redhat.com vendor-advisory
- [tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- Debian Security Tracker CVE-2008-5519 vendor-advisory
- bugs.debian.org issue-tracking