"secret" parameter not available in mod_proxy_ajp on focal
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apache2 (Ubuntu) |
Fix Released
|
High
|
Andreas Hasenack |
Bug Description
AJP needs a "secret" parameter on focal since tomcat9 9.0.31-1. Likely this change was triggered by CVE-2020-1938 (Ghostcat).
Unfortunately, in Apache 2.4 this parameter is not available yet in the stable version 2.4.41 (currently only in the development branch 2.5). When setting the "secret" parameter via
ProxyPass / ajp://localhost
the following error appears in the service log:
ProxyPass unknown Worker parameter
Workaround:
Use 'secretRequired
Proposed fix:
Port the "secret" parameter in mod_proxy_ajp back to Apache 2.4, advise users to create a reasonable secret.
Related branches
- Christian Ehrhardt (community): Approve
- Thomas (community): Approve (test)
- Canonical Server: Pending requested
-
Diff: 259 lines (+231/-0)4 files modifieddebian/changelog (+7/-0)
debian/patches/mod_proxy_ajp-secret-parameter-doc.patch (+32/-0)
debian/patches/mod_proxy_ajp-secret-parameter.patch (+190/-0)
debian/patches/series (+2/-0)
CVE References
tags: | added: focal |
summary: |
- "secret" parameter not available in mod_proxy_ajp + "secret" parameter not available in mod_proxy_ajp on focal |
description: | updated |
description: | updated |
Changed in apache2 (Ubuntu): | |
status: | Triaged → In Progress |
assignee: | nobody → Andreas Hasenack (ahasenack) |
description: | updated |
https:/ /httpd. apache. org/docs/ 2.4/mod/ mod_proxy_ ajp.html seems to indicate "secret" will be available in 2.4.42:
?secret 0x0C String Supported since 2.4.42
From https:/ /bugzilla. redhat. com/show_ bug.cgi? id=1397241, looks like redhat has had "secret" support for quite a while. That bug report links to this changeset:
https:/ /svn.apache. org/viewvc? view=revision& revision= 1738878
Looks like this is the 2.4.42 commit: /github. com/apache/ httpd/commit/ d8b6d798c177dfd b90cef1a29395af cc043f3c86
https:/
With a follow-up doc update: /github. com/apache/ httpd/commit/ 4de7604dd086c7b ebdcab4ae9dbbec 24b59edabc
https:/
I grabbed the above from the 2.4.x branch