CVE catalog

CVE-2024-46544

Apache Tomcat Connectors vulnerability

Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected. Users are recommended to upgrade to version 1.2.50, which fixes the issue.

Severity: Medium · CVSS 6.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Published: Sep 23, 2024, 11:15:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.33% · Oct 27, 2026

Projects and upstream resources

[libapache-mod-jk][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	libapache-mod-jk	`1:1.2.50-1`	FixedDistribution-reported fixed boundary	[CVE-2024-46544]
Debiansid	libapache-mod-jk	`1:1.2.50-1`	FixedDistribution-reported fixed boundary	[CVE-2024-46544]
Debianforky	libapache-mod-jk	`1:1.2.50-1`	FixedDistribution-reported fixed boundary	[CVE-2024-46544]
Debianbookworm	libapache-mod-jk	`1:1.2.48-2+deb12u2`	FixedDistribution-reported fixed boundary	[CVE-2024-46544]

Showing 4 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	libapache-mod-jk	`1:1.2.49-1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	libapache-mod-jk-doc	`1:1.2.49-1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	libapache2-mod-jk	`1:1.2.49-1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	libapache-mod-jk	`1:1.2.48-2+deb12u2`	FixedDistribution-reported fixed boundary	[CVE-2024-46544]
Debianforky	libapache-mod-jk	`1:1.2.50-1`	FixedDistribution-reported fixed boundary	[CVE-2024-46544]
Debiansid	libapache-mod-jk	`1:1.2.50-1`	FixedDistribution-reported fixed boundary	[CVE-2024-46544]
Debiantrixie	libapache-mod-jk	`1:1.2.50-1`	FixedDistribution-reported fixed boundary	[CVE-2024-46544]
Suselinux enterprise server ltss extended security 12 sp5	apache2-mod_jk	`1.2.50-7.12.1`	UnknownSource applicability is not established	[SUSE-SU-2025:0143-1]Feb 4, 2026, 2:25:33 AM UTC
Ubuntupro	libapache-mod-jk	`1:1.2.48-2`	UnknownSource applicability is not established	[USN-8369-1]Jun 2, 2026, 6:33:03 PM UTC[UBUNTU-CVE-2024-46544]Jun 2, 2026, 6:16:10 PM UTC
Ubuntupro	libapache-mod-jk	`1:1.2.49-1`	UnknownSource applicability is not established	[USN-8369-1]Jun 2, 2026, 6:33:03 PM UTC[UBUNTU-CVE-2024-46544]Jun 2, 2026, 6:16:10 PM UTC
Ubuntupro	libapache-mod-jk	`1:1.2.49-1build1`	UnknownSource applicability is not established	[USN-8369-1]Jun 2, 2026, 6:33:03 PM UTC[UBUNTU-CVE-2024-46544]Jun 2, 2026, 6:16:10 PM UTC
Ubuntupro	libapache-mod-jk	`1:1.2.49-1ubuntu0.1~esm1`	UnknownSource applicability is not established	[USN-8369-1]Jun 2, 2026, 6:33:03 PM UTC[UBUNTU-CVE-2024-46544]Jun 2, 2026, 6:16:10 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "libapache-mod-jk",
      "status": "fixed",
      "release": "sid",
      "version": "1:1.2.50-1"
    },
    {
      "name": "libapache-mod-jk",
      "status": "fixed",
      "release": "forky",
      "version": "1:1.2.50-1"
    },
    {
      "name": "libapache-mod-jk",
      "status": "fixed",
      "release": "trixie",
      "version": "1:1.2.50-1"
    },
    {
      "name": "libapache-mod-jk",
      "status": "fixed",
      "release": "bookworm",
      "version": "1:1.2.48-2+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1082713,
      "name": "libapache-mod-jk",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.2.50-1"
    },
    {
      "bug": 1082713,
      "name": "libapache-mod-jk",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.2.50-1"
    },
    {
      "bug": 1082713,
      "name": "libapache-mod-jk",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.2.50-1"
    },
    {
      "bug": 1082713,
      "name": "libapache-mod-jk",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.2.48-2+deb12u2"
    }
  ],
  "distribution_packages": [
    {
      "name": "libapache-mod-jk",
      "fixed_version": "1:1.2.49-1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "libapache-mod-jk-doc",
      "fixed_version": "1:1.2.49-1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "libapache2-mod-jk",
      "fixed_version": "1:1.2.49-1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "libapache-mod-jk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:1.2.49-1ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1:1.2.48-2",
        "1:1.2.49-1",
        "1:1.2.49-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8369-1",
      "fixed_version": "1:1.2.49-1ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-8369-1",
      "provider_updated_at": "2026-06-02T18:33:03.884269693Z",
      "applicability_unknown": true
    },
    {
      "name": "libapache-mod-jk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:1.2.49-1ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1:1.2.48-2",
        "1:1.2.49-1",
        "1:1.2.49-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-46544",
      "fixed_version": "1:1.2.49-1ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-46544",
      "provider_updated_at": "2026-06-02T18:16:10.548160170Z",
      "applicability_unknown": true
    },
    {
      "name": "apache2-mod_jk",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.50-7.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server ltss extended security 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2025:0143-1",
      "fixed_version": "1.2.50-7.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2025:0143-1",
      "provider_updated_at": "2026-02-04T02:25:33.365494Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1082713]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libapache2-mod-jk]Unknown
Source package: [libapache-mod-jk]
Details (2)
- 1:1.2.48-2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1:1.2.48-2+deb12u2
  usn · libapache-mod-jk · debian · bookworm; usn · libapache-mod-jk · debian · 12
- 1:1.2.48-2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1:1.2.48-2+deb12u2
  usn · libapache-mod-jk · debian · bookworm; usn · libapache-mod-jk · debian · 12
[libapache-mod-jk-doc]Unknown
Source package: [libapache-mod-jk]
Details (2)
- 1:1.2.48-2+deb12u2 · all · bookworm
  Fixed · Fixed: 1:1.2.48-2+deb12u2
  usn · libapache-mod-jk · debian · bookworm; usn · libapache-mod-jk · debian · 12
- 1:1.2.48-2+deb12u2 · all · bookworm
  Fixed · Fixed: 1:1.2.48-2+deb12u2
  usn · libapache-mod-jk · debian · bookworm; usn · libapache-mod-jk · debian · 12

[Debian 13 (Trixie)]

[libapache2-mod-jk]Unknown
Source package: [libapache-mod-jk]
Details (2)
- 1:1.2.50-1 · amd64 · trixie
  Fixed · Fixed: 1:1.2.50-1
  usn · libapache-mod-jk · debian · 13
- 1:1.2.50-1 · arm64 · trixie
  Fixed · Fixed: 1:1.2.50-1
  usn · libapache-mod-jk · debian · 13
[libapache-mod-jk-doc]Unknown
Source package: [libapache-mod-jk]
Details (2)
- 1:1.2.50-1 · all · trixie
  Fixed · Fixed: 1:1.2.50-1
  usn · libapache-mod-jk · debian · 13
- 1:1.2.50-1 · all · trixie
  Fixed · Fixed: 1:1.2.50-1
  usn · libapache-mod-jk · debian · 13

Observed: Oct 27, 2026, 1:57:16 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]