Red Hat Security Advisory

RHSA-2023:1593

httpd security update

Released 2023-04-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-98.el7_9.7, httpd-devel-2.4.6-98.el7_9.7, httpd-manual-2.4.6-98.el7_9.7 +5
Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-98.el7_9.7, httpd-devel-2.4.6-98.el7_9.7, httpd-manual-2.4.6-98.el7_9.7 +5
Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-98.el7_9.7, httpd-devel-2.4.6-98.el7_9.7, httpd-manual-2.4.6-98.el7_9.7 +3
Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-98.el7_9.7, mod_proxy_html-1:2.4.6-98.el7_9.7
Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-98.el7_9.7, httpd-devel-2.4.6-98.el7_9.7, httpd-manual-2.4.6-98.el7_9.7 +3
Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-98.el7_9.7, mod_proxy_html-1:2.4.6-98.el7_9.7

TI-2023-10967 CVE-2023-25690 · GHSA-wc6r-9c75-44gq

CRITICAL 90

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.84508 Published 2023-03-07 Partial fix CWE-444