Siteminder Access Gateway Apache mod_jk vulnerability CVE-2023-41081

Products

• SITEMINDER

Issue/Introduction

Siteminder Access Gateway  version 12.8 SP7 and lower ships with mod_jk version 1.2.48 or lower release which may cause it to be vulnerable to CVE-2023-41081 per apache release note --> https://tomcat.apache.org/security-jk.html#Fixed_in_Apache_Tomcat_JK_Connector_1.2.49

 

Environment

Access Gateway 12.8 SP7 or lower releases 

Resolution

Siteminder Access Gateway 12.8 SP8 CR01 already ships with mod_jk version 1.2.49.

If you are running on a version below 12.8 SP7 or lower, you can manually upgrade the mod_jk by upgrading to the apache 2.4.59 as indicated in KB --> https://knowledge.broadcom.com/external/article/282288/vulnerability-in-apache-2458-and-older-i.html 

Apache 2.4.59 released by Broadcom comes with the upgraded mod_jk 1.2.49.