CVE-2008-5519 Information disclosure in n/a
Remote attackers can obtain sensitive information from Apache Tomcat via specific HTTP requests due to AJP protocol noncompliance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-5519?
CVE-2008-5519 is a low-severity vulnerability in Apache Tomcat, published on 9 Apr 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
Weakness: CWE-200
Which versions are affected by CVE-2008-5519?
It affects 2 products.
Linux distribution packages (13)
mod_jk Red Hat:network_satellite:5.1::el4 | All versions | 0:1.2.25-10 |
mod_jk-ap20 Red Hat:network_satellite:5.1::el4 | All versions | 0:1.2.25-10 |
mod_jk-debuginfo Red Hat:network_satellite:5.1::el4 | All versions | 0:1.2.25-10 |
mod_jk Red Hat:network_satellite:5.2::el4 | All versions | 0:1.2.25-10 |
mod_jk-ap20 Red Hat:network_satellite:5.2::el4 | All versions | 0:1.2.25-10 |
mod_jk-debuginfo Red Hat:network_satellite:5.2::el4 | All versions | 0:1.2.25-10 |
mod_jk Red Hat:rhel_application_server:2 | All versions | 0:1.2.28-1jpp_3rh |
mod_jk-ap20 Red Hat:rhel_application_server:2 | All versions | 0:1.2.28-1jpp_3rh |
mod_jk-debuginfo Red Hat:rhel_application_server:2 | All versions | 0:1.2.28-1jpp_3rh |
mod_jk-manual Red Hat:rhel_application_server:2 | All versions | 0:1.2.28-1jpp_3rh |
mod_jk Red Hat:rhel_application_stack:2 | All versions | 0:1.2.28-1.el5s2 |
mod_jk-ap20 Red Hat:rhel_application_stack:2 | All versions | 0:1.2.28-1.el5s2 |
mod_jk-debuginfo Red Hat:rhel_application_stack:2 | All versions | 0:1.2.28-1.el5s2 |
Products include Apache Mod Jk, Apache Tomcat.
How do I fix CVE-2008-5519?
Upgrade to a fixed version.
Is CVE-2008-5519 being exploited?
There is no known exploitation of CVE-2008-5519 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as DEBIAN-CVE-2008-5519, DSA-1810-1, GHSA-3v4j-mhgf-pf6w, RHSA-2009:0446, RHSA-2009:1087, RHSA-2009:1618.