Siteminder Access Gateway Apache mod_jk vulnerability CVE-2023-41081

Products

• SITEMINDER

Issue/Introduction

Siteminder Access Gateway  version 12.8 SP7 and lower ships with mod_jk version 1.2.48 or lower release which may cause it to be vulnerable to CVE-2023-41081 per apache release note --> https://tomcat.apache.org/security-jk.html#Fixed_in_Apache_Tomcat_JK_Connector_1.2.49

Environment

Access Gateway 12.8 SP7 or lower releases 

Resolution

Siteminder Access Gateway 12.8 SP8 CR01 already ships with mod_jk version 1.2.49.

If you are running on a version below 12.8 SP7 or lower, you can manually upgrade the mod_jk by upgrading to the apache 2.4.59 as indicated in KB Vulnerability in Apache 2.4.61 and older in Siteminder Access Gateway

Apache 2.4.61 released by Broadcom comes with the upgraded mod_jk 1.2.49.