CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability
Severity: important
Vendor: The Apache Software Foundation
Versions Affected:
mod_jk 1.2.0 to 1.2.26
Description:
Situations where faulty clients set Content-Length without providing
data, or where a user submits repeated requests very quickly may permit
one user to view the response associated with a different user's request.
Mitigation:
Upgrade to mod_jk 1.2.27 or later
Example:
See description
Credit:
This issue was discovered by the Red Hat Security Response Team
References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-jk.html
The Apache Tomcat Security Team
The Apache Tomcat team is pleased to announce the immediate availability of version 1.2.28 of the Apache Tomcat Connectors.
It contains connectors, which allow a web server such as the Apache HTTP Server, Microsoft IIS and Sun Web Server to act as a front end to the Tomcat web application server.
This version contains mainly some bug fixes and small improvements.
See http://tomcat.apache.org/connectors-doc/news/20090301.html#22%20March%20-%20JK-1.2.28%20released
for an overview and
http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html
for a complete list of changes.
Source distribtions can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Binary distributions for a number of different operating systems and web servers can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Documentation for using Apache Tomcat Connectors can be found at:
http://tomcat.apache.org/connectors-doc/
Thank you,
The Apache Tomcat team is proud to announce the immediate availability of Tomcat Native 1.1.16 stable. This build contains a small number of bug fixes over the previous release.
Please refer to the changelog:
http://tomcat.apache.org/native-doc/miscellaneous/changelog.html
for a complete list of changes.
Downloads: http://tomcat.apache.org/download-native.cgi
Note: This announcement note has been sent later then actual release was made because of delayed voting.
----
The Apache Tomcat team is pleased to announce the immediate availability of version 1.2.27 of the Apache Tomcat Connectors.
It contains connectors, which allow a web server such as Apache HTTPD, Microsoft IIS and Sun Web Server to act as a front end to the Tomcat web application server.
This version contains several enhancements, like e.g.
and also fixes a number of minor bugs.
See
http://tomcat.apache.org/connectors-doc/news/20081001.html#28%20October%20-%20JK-1.2.27%20released
for a more detailed description and
http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html
for a complete list of changes.
Source distribtions can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Binary distributions for a number of different operating systems and web servers can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Syncing the release to the download mirrors might take up to 48 hours.
Documentation for using Apache Tomcat Connectors can be found at:
http://tomcat.apache.org/connectors-doc/
Thank you,
----
The Apache Tomcat team announces the immediate availability of Apache Tomcat 6.0.18 stable. This release includes many bugfixes over Apache Tomcat 6.0.16.
Apache Tomcat 6.0 includes new features over Apache Tomcat 5.5, including support for the new Servlet 2.5 and JSP 2.1 specifications, a refactored clustering implementation, advanced IO features, and improvements in memory usage.
Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html
Downloads: http://tomcat.apache.org/download-60.cgi
Migration guide from Apache Tomcat 5.5.x: http://tomcat.apache.org/migration.html
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.37 stable. This build contains numerous library updates, a small number of bug fixes and two important, one moderate and six low severity security fixes.
Apache Tomcat is an implementation of the Java Server Pages 1.2 and Java Servlet 2.3 specifications.
Please refer to the release notes for a complete list of changes.
Downloads: http://tomcat.apache.org/download-41.cgi
Security information: http://tomcat.apache.org/security-4.html
----
The Apache Tomcat team announces the immediate availability of Apache Tomcat 6.0.16 stable. This release includes many bugfixes over Apache Tomcat 6.0.14.
Apache Tomcat 6.0 includes new features over Apache Tomcat 5.5, including support for the new Servlet 2.5 and JSP 2.1 specifications, a refactored clustering implementation, advanced IO features, and improvements in memory usage.
Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html
Downloads: http://tomcat.apache.org/download-60.cgi
Migration guide from Apache Tomcat 5.5.x: http://tomcat.apache.org/migration.html
----
The Apache Tomcat team announces the immediate availability of Apache Tomcat 5.5.26 stable.
Apache Tomcat 5.5.26 incorporates numerous security updates and bug fixes. Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://tomcat.apache.org/download-55.cgi
----
Apache Tomcat JK 1.2.26 Web Server Connector released
The Apache Tomcat team is pleased to announce the immediate availability of version 1.2.26 of the Apache Tomcat Connectors.
It contains connectors, which allow a web server such as Apache HTTPD, Microsoft IIS and Sun Web Server to act as a front end to the Tomcat web application server.
This version contains a few enhancements and fixes a number of minor bugs of the previous versions.
See http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html for a complete list of changes.
Source distribtions can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Binary distributions for a number of different operating systems and web servers can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Syncing the release to the download mirrors might take up to 48 hours.
Documentation for using Apache Tomcat Connectors can be found at:
http://tomcat.apache.org/connectors-doc/
Thank you,
----
-- Merry Christmas from The Apache Tomcat Team
The Apache Tomcat team announces the immediate availability of Apache Tomcat 6.0.14 stable. This release includes bugfixes over Apache Tomcat 6.0.13.
Apache Tomcat 6.0 includes new features over Apache Tomcat 5.5, including support for the new Servlet 2.5 and JSP 2.1 specifications, a refactored clustering implementation, advanced IO features, and improvements in memory usage.
Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html
Downloads: http://tomcat.apache.org/download-60.cgi
Migration guide from Apache Tomcat 5.5.x: http://tomcat.apache.org/migration.html
----
The Apache Tomcat team is pleased to announce the immediate availability of version 1.2.25 of the Apache Tomcat Connectors.
It contains connectors, which allow a web server such as Apache HTTPD, Microsoft IIS and Sun Web Server to act as a front end to the Tomcat web application server.
This version contains several enhancements and fixes a number of minor bugs of the previous versions.
See http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html for a complete list of changes.
Source distribtions can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Binary distributions for a number of different operating systems and web servers can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Syncing the release to the download mirrors might take up to 48 hours.
Documentation for using Apache Tomcat Connectors can be found at:
http://tomcat.apache.org/connectors-doc/
----
The Apache Tomcat team is pleased to announce the immediate availability of version 1.2.24 of the Apache Tomcat Connectors.
It contains connectors, which allow a web server such as Apache HTTPD, Microsoft IIS and Sun Web Server to act as a front end to the Tomcat web application server.
This version contains several enhancements and fixes a number of minor bugs of the previous version 1.2.23.
See http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html for a complete list of changes.
Source distribtions can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Binary distributions for a number of different operating systems and web servers can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Documentation for using Apache Tomcat Connectors can be found at:
http://tomcat.apache.org/connectors-doc/
----
The Apache Tomcat team is pleased to announce the immediate availability of version 1.2.23 of the Apache Tomcat Connectors.
It contains connectors, which allow a web server such as Apache HTTPD, Microsoft IIS and Sun Web Server to act as a front end to the Tomcat web application server.
This version contains only one security fix:
CVE-2007-1860: Information disclosure (patch for CVE-2007-0450 was insufficient)
With the mod_jk default configuration, double encoded URLs could break JkMount access control. A complete fix might need configuration adjustments. Please consult
http://tomcat.apache.org/security-jk.html
for a more detailed description. Please note, that this issue only affected the Apache HTTPD module mod_jk.
Source distribtions can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Binary distributions for a number of different operating systems and web servers can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Documentation for using JK with Tomcat 3.3, 4.1, 5.0 and 5.5 can be found at:
http://tomcat.apache.org/connectors-doc/
----
The Apache Tomcat team announces the immediate availability of Apache Tomcat 6.0.13 stable. This release is the second stable release of the 6.0.x branch, and includes bugfixes over Apache Tomcat 6.0.10.
Apache Tomcat 6.0 includes new features over Apache Tomcat 5.5, including support for the new Servlet 2.5 and JSP 2.1 specifications, a refactored clustering implementation, advanced IO features, and improvements in memory usage.
Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html
Downloads: http://tomcat.apache.org/download-60.cgi
Migration guide from Apache Tomcat 5.5.x: http://tomcat.apache.org/migration.html
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.36 stable. This build contains numerous library updates, a small number of bug fixes and two important security fixes.
Apache Tomcat is an implementation of the Java Server Pages 1.2 and Java Servlet 2.3 specifications.
Please refer to the release notes for a complete list of changes.
Downloads: http://tomcat.apache.org/download-41.cgi
Security information: http://tomcat.apache.org/security-4.html
----
The Apache Tomcat team announces the immediate availability of Apache Tomcat 6.0.10 stable. This release is the first stable release of the 6.0.x branch.
Apache Tomcat 6.0 includes new features over Apache Tomcat 5.5, including support for the new Servlet 2.5 and JSP 2.1 specifications, a refactored clustering implementation, advanced IO features, and improvements in memory usage.
Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html
Downloads: http://tomcat.apache.org/download-60.cgi
Migration guide from Apache Tomcat 5.5.x: http://tomcat.apache.org/migration.html
----
The Apache Tomcat team is pleased to announce the immediate availability of version 1.2.20 of the Apache Tomcat Connectors.
It contains connectors, which allow a web server such as Apache HTTPD, Microsoft IIS and Sun Web Server to act as a front end to the Tomcat web application server.
This version contains several enhancements and fixes a number of minor bugs of the previous version 1.2.19.
See http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html for a complete list of changes.
Source distribtions can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Binary distributions for a number of different operating systems and web servers can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Documentation for using JK with Tomcat 3.3, 4.1, 5.0 and 5.5 can be found at:
http://tomcat.apache.org/connectors-doc/
Thank you,
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.34 stable. This build contains numerous bug fixes, documentation updates, and other improvements.
Apache Tomcat is an implementation of the Java Server Pages 1.2 and Java Servlet 2.3 specifications.
Please refer to the release notes for a complete list of changes.
Downloads:
http://tomcat.apache.org/download-41.cgi
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.34-beta. This release is a bug fix release that resolves the issues reported against Tomcat 4.1.32-beta. Please consult the release notes included in the distributions for more details.
Downloads: http://tomcat.apache.org/download-41.cgi
The Apache Tomcat team is proud to announce the immediate availability of Tomcat v4.1.32-beta. This release contains dozens of bug fixes and a number of other updates. Please consult the release notes included in the distributions for more details.
Downloads: http://tomcat.apache.org/download-41.cgi
Thank you,
----
The Apache Tomcat Team has voted to the v5.5.17 release as stable. You can see the stability vote results at http://marc.theaimsgroup.com/?l=tomcat-dev&m=114614639118049&w=2, and you may find the following links useful:
Release Notes: http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Change Log: http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://tomcat.apache.org/download-55.cgi
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat v5.5.17-beta. This release contains dozens of bug fixes and a number of other updates. Please consult the change log below for more details.
Release Notes: http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Change Log: http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://tomcat.apache.org/download-55.cgi
Thank you,
----
The Apache Tomcat Team has voted to certify v5.5.16 as stable. Binding +1 votes were cast by Mladen Turk, Peter Rossbach, Remy Maucherat, Henri Gomez, Jeanfrancois Arcand, and Yoav Shapira.
The web site will be updated shortly to reflect the result of this vote. You can also inspect the:
Release Notes: http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Change Log: http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://tomcat.apache.org/download-55.cgi
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat v5.5.16-beta. This release contains dozens of bug fixes and a number of other updates. Please consult the change log below for more details.
Release Notes: http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Change Log: http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://tomcat.apache.org/download-55.cgi
Thank you,
----
The Apache Tomcat team has voted the 5.5.15 release as stable, with binding +1 votes from Peter Rossbach, Remy Maucherat, Jim Jagielski, Mladen Turk, and Jeanfrancois Arcand.
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat v5.5.15-beta. This is primarily a bug fix release: consult the change log below for more details.
Release Notes: http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Change Log: http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://tomcat.apache.org/download-55.cgi
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat 5.5.14-beta. This main change in this version is an update of the APR optional dependency to version 1.1.1, and related configuration changes for the APR connector and installer. There are a few additional bugs fixed, as detailed in the change log.
Because of the quickness and contents of this release, 5.5.13-beta will stay a beta release: it will not receive a stability vote. Instead, we will vote as usual on 5.5.14 stability approximately a week from today.
Thank you,
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat 5.5.13-beta. This version contains several important bug fixes, minor feature additions, and documentation enhancements. This is also the first release to be cut from the Tomcat SVN repository at Apache: the previous CVS repository is no longer used. Please note that with Tomcat's move to its own top-level project outside Jakarta, the following links are at new locations:
Release Notes: http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Change Log: http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://tomcat.apache.org/download-55.cgi
Thank you,
----
The Apache Tomcat team is pleased to announce the release of version 1.2.15 of the Apache Tomcat mod_jk web server connector.
Tomcat is the reference implementation of a web application server which implements the Java Servlet and JavaServer Pages specifications.
mod_jk is a connector which allows a web server such as Apache HTTPD to act as a front end to the Tomcat web application server. This version fixes a number of minor bugs.
See http://tomcat.apache.org/connectors-doc/changelog.html for a complete list of changes.
Source distribtions can be downloaded from an Apache Software Foundation mirror at: (they are named jakarta-tomcat-connectors-1.2.15-src.tar.gz and jakarta-tomcat-connectors-1.2.15-src.zip)
http://tomcat.apache.org/download-connectors.cgi
Binary distributions for a number of different operating systems and web servers can be downloaded from an Apache Software Foundation mirror at:
http://tomcat.apache.org/download-connectors.cgi
Documentation for using mod_jk with Tomcat 3.3, 4.1, 5.0 and 5.5 can be found at:
http://tomcat.apache.org/connectors-doc/
----
The Apache Tomcat Project is now on the process of migrating from a subproject under the umbrella of the Apache Jakarta Project into its own TLP (Top Level Project) in the Apache Software Foundation.
New Website:
http://tomcat.apache.org/
Stay tuned.
cf. Communities/Projects in the Apache Software Foundation
The Apache Tomcat Team has marked version 5.5.12-alpha of Tomcat as "stable release".
There have been no code changes since the alpha release, so if you already have the 5.5.12-alpha distribution you don't have to go download pages.
The Release notes are available at
http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Please refer to the change log for the list of changes:
http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://jakarta.apache.org/site/downloads/downloads_tomcat-5.cgi
----
The Apache Tomcat team is proud to announce the immediate availability of Tomcat 5.5.12-alpha. This version contains several bug fixes, including an import change to session attribute storage concurrency that is required by the upcoming Servlet Specification v2.5. In addition to these changes, this release is a significant milestone for two reasons:
This release is the last one to be done using the CVS repository at Apache. The Tomcat team is moving to the Subversion (SVN) repository as part of the overall Apache initiative to do so. Access instructions for the SVN repository are available at http://www.apache.org/dev/version-control.html. The move is expected to be complete within the next week.
As part of Tomcat's move to a top-level project (TLP) at Apache, we will be migrating our content to http://tomcat.apache.org, which is still under construction at this time. That site will have its own download pages and related information. We will keep the key jakarta URLs intact with redirection, but please keep an eye out and update your bookmarks to http://tomcat.apache.org as/when appropriate. As part of the TLP move, distribution names have changed from jakarta-tomcat-* to apache-tomcat-*, and similar minor branding changes will gradually become visible in the web site and documentation. We thank the Jakarta project for its support over the years, and we will continue collaborating on projects and issues of common interest.
The Release notes are available at
http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Please refer to the change log for the list of changes:
http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads: http://jakarta.apache.org/site/downloads/downloads_tomcat-5.cgi
----
The Apache Jakarta Tomcat team is proud to announce the immediate availability of Tomcat 5.5.10-alpha. This build contains 110 improvements, including bug fixes, enhancements, and documentation updates. There are several interesting new features, such as Apache Portable Runtime (APR)-based HTTP/1.1 and AJP/1.3 protocol handlers with SSL support, an experimental NIO-Socket channel for the AJP/1.3 connector, improved support for Java 5 using the Eclipse 3.1 JDT, clustering support at the Engine and Host levels, and more.
The Release notes are available at
http://tomcat.apache.org/tomcat-5.5-doc/RELEASE-NOTES
Please refer to the change log for the list of changes:
http://tomcat.apache.org/tomcat-5.5-doc/changelog.html
Downloads:
http://jakarta.apache.org/site/downloads/downloads_tomcat-5.cgi
----
-- The Apache Jakarta Tomcat Team
Establish the Apache Tomcat Project
WHEREAS, the Board of Directors deems it to be in the best
interests of the Foundation and consistent with the Foundation's
purpose to establish a Project Management Committee charged with
the creation and maintenance of open-source software related to
the implementation of the Java Servlet and Java Server Pages
specifications, for distribution at no charge to the public.
NOW, THEREFORE, BE IT RESOLVED, that a Project Management
Committee (PMC), to be known as the "Apache Tomcat PMC", be and
hereby is established pursuant to Bylaws of the Foundation; and
be it further
RESOLVED, that the Apache Tomcat PMC be and hereby is
responsible for the creation and maintenance of software related
to creation and maintenance of open-source software related to
the implementation of the Java Servlet and Java Server Pages
specifications based on software licensed to the Foundation; and
be it further
RESOLVED, that the office of "Vice President, Apache Tomcat" be
and hereby is created, the person holding such office to serve
at the direction of the Board of Directors as the chair of the
Apache Tomcat PMC, and to have primary responsibility for
management of the projects within the scope of responsibility of
the Apache Tomcat PMC; and be it further
RESOLVED, that the persons listed immediately below be and
hereby are appointed to serve as the initial members of the
Apache Tomcat PMC:
Jean-Francois Arcand (jfarcand@apache.org)
Bill Barker (billbarker@apache.org)
Kin-man Chung (kinman@apache.org)
Jean-Frederic Clere (jfclere@apache.org)
Ian Darwin (idarwin@apache.org)
Tim Funk (funkman@apache.org)
Henri Gomez (hgomez@apache.org)
Filip Hanik (fhanik@apache.org)
Larry Isaacs (larryi@apache.org)
Jim Jagielski (jim@apache.org)
Jan Luehe (luehe@apache.org)
Costin Manolache (costin@apache.org)
Remy Maucherat (remm@apache.org)
Kurt Miller (truk@apache.org)
Glenn Nielsen (glenn@apache.org)
Amy Roh (amyroh@apache.org)
Peter Rossbach (pero@apache.org)
Yoav Shapira (yoavs@apache.org)
Mark Thomas (markt@apache.org)
Mladen Turk (mturk@apache.org)
Keith Wannamaker (keith@apache.org)
NOW, THEREFORE, BE IT FURTHER RESOLVED, that Remy Maucherat be
appointed to the office of Vice President, Apache Tomcat, to
serve in accordance with and subject to the direction of the
Board of Directors and the Bylaws of the Foundation until death,
resignation, retirement, removal or disqualification, or until a
successor is appointed; and be it further
RESOLVED, that the initial Apache Tomcat PMC be and hereby is
tasked with the creation of a set of bylaws intended to
encourage open development and increased participation in the
Apache Tomcat Project; and be it further
RESOLVED, that the initial Apache Tomcat PMC be and hereby is
tasked with the migration and rationalization of the Apache
Jakarta PMC Tomcat subproject; and be it further
RESOLVED, that all responsibility pertaining to the Jakarta
Tomcat sub-project and encumbered upon the Apache Jakarta PMC
are hereafter discharged.
Special Order B, a Resolution to Establish the Apache Tomcat
Project, was tabled to allow the board to investigate some
concerns.
----
-- May 18, 2005 --
The Board of Directors of the Apache Software Foundation (ASF) promoted the Apache Jakarta Tomcat to its own top-level project (TLP). Tomcat is one of the ASF's oldest projects and serves as the world's reference implementation for a Java servlet container. This new TLP will be chaired by Remy Maucherat.