CVE-2009-1191

Publication date 23 April 2009

Last updated 24 July 2024

mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	9.04 jaunty	Fixed 2.2.11-2ubuntu2.1
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	6.06 LTS dapper	Not affected

How can I get the fixes?
What do statuses mean?

Notes

jdstrand

affected code only in 2.2.11 (Ubuntu 9.04)

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-787-1
Apache vulnerabilities
11 June 2009

Other references

https://www.cve.org/CVERecord?id=CVE-2009-1191