{"id":"CVE-2023-41081","aliases":["ALSA-2024:2387","CLSA-2025-1763032400","DEBIAN-CVE-2023-41081","DLA-3580-1","EUVD-2023-45601","GHSA-4wvr-fq5p-2362","MGASA-2024-0130","RHSA-2023:7625","RHSA-2024:2387","SUSE-SU-2024:1198-1","SUSE-SU-2025:0102-1","UBUNTU-CVE-2023-41081","USN-6826-1","USN-8369-2"],"status":"published","title":"Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request","description":"Important: Authentication Bypass CVE-2023-41081\n\nThe mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included \"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\nHistory\n2023-09-13 Original advisory\n\n2023-09-28 Updated summary","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01589,"percentile":0.75993,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-09-13T09:30:05Z","modified":"2026-10-29T11:31:07Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_jk","fixed_in":["1.2.48-23.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libapache-mod-jk","fixed_in":["1:1.2.48-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache-mod-jk","fixed_in":["1:1.2.49-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache-mod-jk","fixed_in":["1:1.2.49-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libapache-mod-jk","fixed_in":["1:1.2.46-1+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"apache-mod_jk","fixed_in":["1.2.49-1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_jk","fixed_in":["1.2.49-7.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_jk","fixed_in":["1.2.49-7.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libapache-mod-jk","fixed_in":["1:1.2.41-1ubuntu0.1~esm1","1:1.2.41-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libapache-mod-jk","fixed_in":["1:1.2.43-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libapache-mod-jk","fixed_in":["1:1.2.46-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libapache-mod-jk","fixed_in":["1:1.2.48-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.49-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.20-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.48-23.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.48-2+deb12u1"}]}],"versions":["1:1.2.48-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.49-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.49-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.46-1+deb10u2"}]}],"versions":["1:1.2.46-1","1:1.2.46-1+deb10u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"apache-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.49-1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-16.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.0-2.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.redhat_1.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.redhat_1.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.redhat_1.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.redhat_1.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.redhat_1.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_jk-ap24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.redhat_1.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-32.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-32.el7jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-32.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.19-32.el8jbcs"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.20-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_jk-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.49-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.49-7.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.49-7.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.50-150100.6.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.50-150100.6.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.41-1ubuntu0.1~esm1"}]}],"versions":["1:1.2.40+svn150520-1","1:1.2.41-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.43-1ubuntu0.1~esm1"}]}],"versions":["1:1.2.42-1","1:1.2.43-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.46-1ubuntu0.1"}]}],"versions":["1:1.2.46-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.48-1ubuntu0.1"}]}],"versions":["1:1.2.48-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.41-1ubuntu0.1~esm1"}]}],"versions":["1:1.2.40+svn150520-1","1:1.2.41-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.43-1ubuntu0.1~esm1"}]}],"versions":["1:1.2.42-1","1:1.2.43-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.46-1ubuntu0.1"}]}],"versions":["1:1.2.46-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.48-1ubuntu0.1"}]}],"versions":["1:1.2.48-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libapache-mod-jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.41-1ubuntu0.1~esm2"}]}],"versions":["1:1.2.40+svn150520-1","1:1.2.41-1","1:1.2.41-1ubuntu0.1~esm1"]}],"products":[{"vendor":"apache","product":"tomcat_connectors"},{"vendor":"apache software foundation","product":"apache tomcat connectors"}],"references":[{"url":"https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b","tags":["vendor-advisory","x_transferred","Mailing List","advisory","article","report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/09/13/2","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/28/7","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41081","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/13/2","tags":["report"]},{"url":"https://github.com/advisories/GHSA-4wvr-fq5p-2362"},{"url":"https://access.redhat.com/errata/RHSA-2024:2387","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41081","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6710","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238847","tags":["report"]},{"url":"https://bugzilla.redhat.com/2254128","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2387.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1763032400.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41081.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41081","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0130.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33083","tags":["report"]},{"url":"https://lwn.net/Articles/969302/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7625","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2207947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227852","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241933","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243877","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7625.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230322.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0465","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0465","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230328.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0466","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-2650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230530.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3446","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3446","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230719.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230731.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38039","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-38039.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38545","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-38545.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38546","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2101","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38546","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2023-38546.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41081","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45802","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45802","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254128","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-27497","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-27511","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2387.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6710","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241198-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167896","tags":["report"]},{"url":"https://bugzilla.suse.com/1206261","tags":["report"]},{"url":"https://bugzilla.suse.com/1215301","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41081","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250102-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230916","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46544","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-41081","tags":["report"]},{"url":"https://tomcat.apache.org/security-jk.html#Fixed_in_Apache_Tomcat_JK_Connector_1.2.49","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6826-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8369-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2161580","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-41081","title":"Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request","description":"Important: Authentication Bypass CVE-2023-41081\n\nThe mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included \"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\nHistory\n2023-09-13 Original advisory\n\n2023-09-28 Updated summary\n\n","status":"published","published":"2023-09-13T09:30:05.584Z","modified":"2024-09-25T17:21:30.509Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:18.88314Z"}],"euvd":[{"id":"EUVD-2023-45601","description":"Important: Authentication Bypass CVE-2023-41081\n\nThe mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included \"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\nHistory\n2023-09-13 Original advisory\n\n2023-09-28 Updated summary\n\n","status":"published","published":"2023-09-13T09:30:05Z","modified":"2024-09-25T17:21:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:12.46898Z"}],"ghsa":[{"id":"GHSA-4wvr-fq5p-2362","title":"The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a...","description":"The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included \"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\n","status":"published","published":"2023-09-13T12:30:21Z","modified":"2024-04-04T07:38:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T14:56:53.773376Z"}],"nvd":[{"id":"CVE-2023-41081","description":"Important: Authentication Bypass CVE-2023-41081\n\nThe mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included \"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\nHistory\n2023-09-13 Original advisory\n\n2023-09-28 Updated summary\n\n","status":"published","published":"2023-09-13T10:15:07.657Z","modified":"2026-06-17T06:20:28.77Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:08:28.268644Z"}],"osv":[{"id":"CVE-2023-41081","title":"Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request","description":"Important: Authentication Bypass CVE-2023-41081\n\nThe mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included \"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\nHistory\n2023-09-13 Original advisory\n\n2023-09-28 Updated summary\n\n","status":"published","published":"2023-09-13T09:30:05.584Z","modified":"2026-10-28T02:30:43.510680611Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-41081","description":"Important: Authentication Bypass CVE-2023-41081  The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included \"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.  This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.  Users are recommended to upgrade to version 1.2.49, which fixes the issue.  History 2023-09-13 Original advisory  2023-09-28 Updated summary","status":"published","published":"2023-09-13T10:15:07.657Z","modified":"2026-10-26T18:02:33.175457972Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"RHSA-2023:7625","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update","status":"published","published":"2024-09-13T21:19:05Z","modified":"2026-10-15T10:06:18Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:2387","title":"Red Hat Security Advisory: mod_jk and mod_proxy_cluster security update","status":"published","published":"2024-09-13T23:58:15Z","modified":"2026-09-21T10:06:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-41081","description":"Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included \"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary","status":"published","published":"2023-09-13T10:15:00Z","modified":"2026-02-04T04:14:13.448773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2387","title":"Moderate: mod_jk and mod_proxy_cluster security update","description":"The mod_jk module is a plugin for the Apache HTTP Server to connect it with the Apache Tomcat servlet engine.\n\nThe mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.\n\nSecurity Fix(es):\n\n* httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure (CVE-2023-41081)\n* mod_cluster/mod_proxy_cluster: Stored Cross site Scripting (CVE-2023-6710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:07.699719197Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2025-1763032400","title":"mod_jk: Fix of CVE-2023-41081","description":"- CVE-2023-41081: fix authentication bypass by removing implicit mapping\n  functionality in mod_jk","status":"published","published":"2025-11-13T11:13:24Z","modified":"2026-06-01T00:31:25.526287841Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3580-1","title":"libapache-mod-jk - security update","status":"published","published":"2023-09-24T00:00:00Z","modified":"2026-03-09T01:19:11.663401Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2024-0130","title":"Updated apache-mod_jk packages fix security vulnerability","description":"The mod_jk component of Apache Tomcat Connectors in some circumstances,\nsuch as when a configuration included \"JkOptions +ForwardDirectories\"\nbut the configuration did not provide explicit mounts for all possible\nproxied requests, mod_jk would use an implicit mapping and map the\nrequest to the first defined worker. Such an implicit mapping could\nresult in the unintended exposure of the status worker and/or bypass\nsecurity constraints configured in httpd. As of JK 1.2.49, the implicit\nmapping functionality has been removed and all mappings must now be via\nexplicit configuration. (CVE-2023-41081)\n","status":"published","published":"2024-04-13T16:56:38Z","modified":"2026-04-16T04:42:57.23786574Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:1198-1","title":"Security update for apache2-mod_jk","description":"This update for apache2-mod_jk fixes the following issues:\n\n- Upgrade from version 1.2.40 to 1.2.49\n- CVE-2023-41081: Fix an information disclosure issue in mod_jk. (bsc#1215301)\n","status":"published","published":"2024-04-10T09:35:25Z","modified":"2026-02-04T03:56:36.831086Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2025:0102-1","title":"Security update for apache2-mod_jk","description":"This update for apache2-mod_jk fixes the following issues:\n\n- Update to version 1.2.50:\n- CVE-2024-46544: Fixed incorrect default permissions vulnerabilitymay that could lead to information disclosure and/or denial of service. (bsc#1230916)\n- CVE-2023-41081: Fixed information disclosure in mod_jk. (bsc#1215301)\n","status":"published","published":"2025-01-14T17:12:47Z","modified":"2026-02-04T04:06:30.105546Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"USN-6826-1","title":"libapache-mod-jk vulnerability","description":"Karl von Randow discovered that mod_jk was vulnerable to an authentication\nbypass. If the configuration did not provide explicit mounts for all\npossible proxied requests, an attacker could possibly use this \nvulnerability to bypass security constraints configured in httpd.\n","status":"published","published":"2024-06-11T12:37:39Z","modified":"2026-06-25T13:30:34.662889244Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-8369-2","title":"libapache-mod-jk regression","description":"USN-8369-1 fixed a vulnerability in mod_jk. It was discovered that for\nUbuntu 18.04 LTS, during the update preparation phase, a previous  fix for\nCVE-2023-41081 was incorrectly dropped. This update  reintroduces the fix\nfor CVE-2023-41081.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that Apache Tomcat Connectors used incorrect default\n permissions for shared memory on Unix-like systems. A local attacker could\n possibly use this issue to view or modify mod_jk configuration data in\n shared memory, resulting in sensitive information exposure or a denial of\n service.","status":"published","published":"2026-07-23T00:33:14Z","modified":"2026-07-23T20:58:20.848203614Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}