The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3580 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3580-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     September 24, 2023                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libapache-mod-jk     Version        : 1:1.2.46-1+deb10u2     CVE ID         : CVE-2023-41081     Debian Bug     : 1051956

    The mod_jk component of Apache Tomcat Connectors, an Apache 2 module to     forward requests from Apache to Tomcat, in some circumstances, such as when     a configuration included JkOptions +ForwardDirectories but the     configuration did not provide explicit mounts for all possible proxied     requests, mod_jk would use an implicit mapping and map the request to the     first defined worker. Such an implicit mapping could result in the     unintended exposure of the status worker and/or bypass security constraints     configured in httpd. As of this security update, the implicit mapping     functionality has been removed and all mappings must now be via explicit     configuration. This issue affects Apache Tomcat Connectors (mod_jk only).

    For Debian 10 buster, this problem has been fixed in version     1:1.2.46-1+deb10u2.

    We recommend that you upgrade your libapache-mod-jk packages.

    For the detailed security status of libapache-mod-jk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libapache-mod-jk

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3580 : libapache-mod-jk-doc - security update

high Nessus Plugin ID 181836

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.0 Sep 25, 2023, 10:10 AM New Plugin Feed: 202309251010