Debian alert DLA-1609-1 (libapache-mod-jk)

From:
             
 
Roberto  C. Sánchez  <roberto@debian.org> 
To:
             
 
debian-lts-announce@lists.debian.org 
Subject:
             
 
[SECURITY] [DLA 1609-1] libapache-mod-jk security update 
Date:
             
 
Mon, 17 Dec 2018 17:14:32 -0500
Message-ID:
             
 
<20181217221432.5awxlktslhyofkie@connexer.com>
Package        : libapache-mod-jk
Version        : 1.2.46-0+deb8u1
CVE ID         : CVE-2018-11759


A vulnerability has been discovered in libapache-mod-jk, the Apache 2
connector for the Tomcat Java servlet engine.

The libapache-mod-jk connector is susceptible to information disclosure
and privilege escalation because of a mishandling of URL normalization.

The nature of the fix required that libapache-mod-jk in Debian 8
"Jessie" be updated to the latest upstream release.  For reference, the
upstream changes associated with each release version are documented
here:

http://tomcat.apache.org/connectors-doc/miscellaneous/cha...

For Debian 8 "Jessie", this problem has been fixed in version
1.2.46-0+deb8u1.

We recommend that you upgrade your libapache-mod-jk packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS