Red Hat Security AdvisoryRHSA-2023:1672
httpd:2.4 security update
Released 2023-04-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) httpd-2.4.37-21.module+el8.2.0+18510+68528e70.6.src::httpd:2.4, httpd-2.4.37-21.module+el8.2.0+18510+68528e70.6.x86_64::httpd:2.4, httpd-devel-2.4.37-21.module+el8.2.0+18510+68528e70.6.x86_64::httpd:2.4 +11
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) httpd-2.4.37-21.module+el8.2.0+18510+68528e70.6.ppc64le::httpd:2.4, httpd-2.4.37-21.module+el8.2.0+18510+68528e70.6.src::httpd:2.4, httpd-2.4.37-21.module+el8.2.0+18510+68528e70.6.x86_64::httpd:2.4 +20
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) httpd-2.4.37-21.module+el8.2.0+18510+68528e70.6.src::httpd:2.4, httpd-2.4.37-21.module+el8.2.0+18510+68528e70.6.x86_64::httpd:2.4, httpd-devel-2.4.37-21.module+el8.2.0+18510+68528e70.6.x86_64::httpd:2.4 +11
Fixes 1 record
Priority CRITICAL 90
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.84508 · Published 2023-03-07 · Partial fix CWE-444
