Red Hat Security AdvisoryRHSA-2023:0852
httpd:2.4 security and bug fix update
Released 2023-02-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-51.module+el8.7.0+18026+7b169787.1.aarch64::httpd:2.4, httpd-2.4.37-51.module+el8.7.0+18026+7b169787.1.ppc64le::httpd:2.4, httpd-2.4.37-51.module+el8.7.0+18026+7b169787.1.s390x::httpd:2.4 +38
Fixes 3 records
Priority MEDIUM 62
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.52718 · Published 2023-01-17 · Partial fix · 2.4.55 CWE-113
Priority MEDIUM 45
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to.
CVSS 3.1CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.01931 · Published 2023-01-17 · Partial fix CWE-444
Priority LOW 39
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03583 · Published 2023-01-17 · Partial fix CWE-787
