Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected. Users are recommended to upgrade to version 1.2.50, which fixes the issue.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:8928 advisory.

    The mod_jk module is a plugin for the Apache HTTP Server to connect it with the Apache Tomcat servlet     engine.

    Security Fix(es):

    * mod_jk: information Disclosure / DoS (CVE-2024-46544)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:8929 advisory.

    The mod_jk module is a plugin for the Apache HTTP Server to connect it with the Apache Tomcat servlet     engine.

    Security Fix(es):

    * mod_jk: information Disclosure / DoS (CVE-2024-46544)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3919 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3919-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     October 14, 2024                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libapache-mod-jk     Version        : 1:1.2.48-1+deb11u2     CVE ID         : CVE-2024-46544     Debian Bug     : 1082713

    It was discovered that there was a configuration issue in     libapache-mod-jk, an Apache web server module used to forward     requests from Apache to Tomcat using the AJP protocol.

    An issue with incorrect default permissions could have allowed local     users to view and modify shared memory containing mod_jk's     configuration, which may have potentially led to information     disclosure and/or a denial of service attack.

    For Debian 11 bullseye, this problem has been fixed in version     1:1.2.48-1+deb11u2.

    We recommend that you upgrade your libapache-mod-jk packages.

    For the detailed security status of libapache-mod-jk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libapache-mod-jk

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:7457 advisory.

    The mod_jk module is an Apache HTTP Server plug-in that enables the Apache HTTP Server to connect with the     Apache Tomcat servlet engine.

    Bug Fix(es):

    * Rebase to upstream 1.2.50 release (JIRA:AlmaLinux-58855)

    Security fix(es):

    * mod_jk: information Disclosure / DoS (CVE-2024-46544) (JIRA:AlmaLinux-59800)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:7457 advisory.

    The mod_jk module is an Apache HTTP Server plug-in that enables the Apache HTTP Server to connect with the     Apache Tomcat servlet engine.

    Bug Fix(es):

    * Rebase to upstream 1.2.50 release (JIRA:RHEL-58855)

    Security fix(es):

    * mod_jk: information Disclosure / DoS (CVE-2024-46544) (JIRA:RHEL-59800)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6927 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under     Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update     experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 6 serves as a     replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 5, and includes bug     fixes and enhancements, which are documented in the Release Notes linked to in the References section.

    Security Fix(es):

    * jbcs-httpd24-httpd: HTTP response splitting (CVE-2023-38709)
    * jbcs-httpd24-mod_jk: information Disclosure / DoS (CVE-2024-46544)

    A Red Hat Security Bulletin which addresses further details about this flaw is available in the References     section.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210429	RHEL 9 : mod_jk (RHSA-2024:8928)	Nessus	Red Hat Local Security Checks	medium
210428	RHEL 9 : mod_jk (RHSA-2024:8929)	Nessus	Red Hat Local Security Checks	medium
208986	Debian dla-3919 : libapache-mod-jk-doc - security update	Nessus	Debian Local Security Checks	medium
208449	AlmaLinux 9 : mod_jk bug fix update (Medium) (ALSA-2024:7457)	Nessus	Alma Linux Local Security Checks	medium
208274	RHEL 9 : mod_jk update (Moderate) (RHSA-2024:7457)	Nessus	Red Hat Local Security Checks	medium
207702	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 (RHSA-2024:6927)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-46544

medium

Tenable Plugins

medium

medium

medium

medium

medium

high