csaf_certbund - WID-SEC-W-2023-2337

WID-SEC-W-2023-2337

Vulnerability from csaf_certbund

Published

2023-09-12 22:00

Modified

2024-06-11 22:00

Summary

Apache Tomcat mod_jk Connector: Schwachstelle ermöglicht Umgehung von Sicherheitsmaßnahmen oder Offenlegung von Informationen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Apache Tomcat ist ein Web-Applikationsserver für verschiedene Plattformen.

Angriff

Ein entfernter anonymer Angreifer kann eine Schwachstelle in Apache Tomcat mod_jk Connector ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme

- Linux - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache Tomcat ist ein Web-Applikationsserver f\u00fcr verschiedene Plattformen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter anonymer Angreifer kann eine Schwachstelle in Apache Tomcat mod_jk Connector ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2337 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2337.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2337 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2337"
      },
      {
        "category": "external",
        "summary": "Apache Security Notification vom 2023-09-12",
        "url": "https://seclists.org/oss-sec/2023/q3/176"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3580 vom 2023-09-24",
        "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7626 vom 2023-12-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:7626"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7625 vom 2023-12-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:7625"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:1198-1 vom 2024-04-10",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018316.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6826-1 vom 2024-06-11",
        "url": "https://ubuntu.com/security/notices/USN-6826-1"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache Tomcat mod_jk Connector: Schwachstelle erm\u00f6glicht Umgehung von Sicherheitsma\u00dfnahmen oder Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2024-06-11T22:00:00.000+00:00",
      "generator": {
        "date": "2024-06-12T08:10:28.206+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-2337",
      "initial_release_date": "2023-09-12T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-09-12T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-09-17T22:00:00.000+00:00",
          "number": "2",
          "summary": "Korrektur Patch-Link"
        },
        {
          "date": "2023-09-24T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2023-12-07T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-04-10T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-06-11T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        }
      ],
      "status": "final",
      "version": "6"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Connector (mod_jk) \u003c1.2.49",
                "product": {
                  "name": "Apache Tomcat Connector (mod_jk) \u003c1.2.49",
                  "product_id": "T029828",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:c"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Tomcat"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1",
                "product": {
                  "name": "Red Hat JBoss Core Services 1",
                  "product_id": "459970",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_core_services:1.0"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Core Services",
                "product": {
                  "name": "Red Hat JBoss Core Services",
                  "product_id": "T012412",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_core_services:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss Core Services"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41081",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Apache Tomcat. Dieser Fehler besteht in der Komponente Connectors (mod_jk) aufgrund einer nicht ordnungsgem\u00e4\u00df konfigurierten impliziten Zuordnung. Ein Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "T000126",
          "T012412",
          "459970"
        ]
      },
      "release_date": "2023-09-12T22:00:00Z",
      "title": "CVE-2023-41081"
    }
  ]
}

cve-2023-41081

Vulnerability from cvelistv5

Published

2023-09-13 09:30

Modified

2024-09-25 17:21

Severity ?

Summary

Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary

References

▼	URL	Tags
	https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b	vendor-advisory
	https://www.openwall.com/lists/oss-security/2023/09/13/2
	https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html
	http://www.openwall.com/lists/oss-security/2023/09/28/7

Impacted products

Vendor

Product

Version

▼

Apache Software Foundation

Apache Tomcat Connectors

Version: 1.2.0 ≤ 1.2.48

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:46:11.826Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/09/13/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/09/28/7"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:tomcat_connectors:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tomcat_connectors",
            "vendor": "apache",
            "versions": [
              {
                "lessThanOrEqual": "1.2.48",
                "status": "affected",
                "version": "1.2.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-41081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T17:18:39.972078Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T17:21:30.509Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat Connectors",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.2.48",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Karl von Randow"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cp\u003eImportant: Authentication Bypass CVE-2023-41081\n\u003cbr\u003e\n\u003c/p\u003e\u003cp\u003eThe mod_jk component of \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eApache Tomcat Connectors\u0026nbsp;\u003c/span\u003ein some circumstances, such as when a configuration included\u0026nbsp;\"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker.\u0026nbsp;\u003cspan style=\"background-color: var(--wht);\"\u003eSuch an implicit mapping could result in the unintended exposure of the\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003estatus worker and/or bypass security constraints configured in httpd. As\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eof JK 1.2.49, the implicit mapping functionality has been removed and all\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003emappings must now be via explicit configuration.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eOnly mod_jk is affected\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eby this issue. The ISAPI redirector is not affected.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Apache Tomcat Connectors \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e(mod_jk only)\u003c/span\u003e: from 1.2.0 through 1.2.48.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\u003c/p\u003e\u003ch2\u003eHistory\u003cbr\u003e\u003c/h2\u003e\u003ch2\u003e\u003c/h2\u003e\u003cp\u003e2023-09-13 Original advisory\n\u003cbr\u003e2023-09-28 Updated summary\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Important: Authentication Bypass CVE-2023-41081\n\nThe mod_jk component of Apache Tomcat Connectors\u00a0in some circumstances, such as when a configuration included\u00a0\"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker.\u00a0Such an implicit mapping could result in the unintended exposure of the\u00a0status worker and/or bypass security constraints configured in httpd. As\u00a0of JK 1.2.49, the implicit mapping functionality has been removed and all\u00a0mappings must now be via explicit configuration.\u00a0Only mod_jk is affected\u00a0by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\nHistory\n2023-09-13 Original advisory\n\n2023-09-28 Updated summary\n\n"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unexpected default behaviour",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-28T21:30:57.072Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/09/13/2"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/09/28/7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-41081",
    "datePublished": "2023-09-13T09:30:05.584Z",
    "dateReserved": "2023-08-22T18:35:12.615Z",
    "dateUpdated": "2024-09-25T17:21:30.509Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted