Red Hat Security AdvisoryRHSA-2023:0970
httpd security and bug fix update
Released 2023-02-28 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) httpd-2.4.53-7.el9_1.1, httpd-core-2.4.53-7.el9_1.1, httpd-devel-2.4.53-7.el9_1.1 +8
Fixes 3 records
Priority MEDIUM 62
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.52718 · Published 2023-01-17 · Partial fix · 2.4.55 CWE-113
Priority MEDIUM 45
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to.
CVSS 3.1CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.01931 · Published 2023-01-17 · Partial fix CWE-444
Priority LOW 39
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03583 · Published 2023-01-17 · Partial fix CWE-787
