Red Hat Security AdvisoryRHSA-2024:1317
Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update
Released 2024-03-18 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat JBoss Core Services
Fixes 7 records
Priority HIGH 68
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01685 · Published 2023-12-07 · Partial fix · 7.46.0 CWE-178
Priority MEDIUM 63
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01133 · Published 2023-12-12 · Partial fix · 7.84.0 CWE-311
Priority MEDIUM 62
Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01079 · Published 2023-08-29 · Partial fix CWE-119
Priority MEDIUM 44
Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0304 · Published 2023-10-23 · Partial fix CWE-125
Priority MEDIUM 42
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01314 · Published 2024-02-04 · Partial fix CWE-416
Priority LOW 38
Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.05091 · Published 2023-11-06 · Partial fix · 1.0.2zj, 1.1.1x +2 CWE-606
Priority LOW 29
A flaw was found in the mod_proxy_cluster in the Apache server.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.02242 · Published 2023-12-12 · Partial fix · 1.3.20-3.el8jbcs, 1.3.20-3.el7jbcs +1 CWE-79
THREATIST.IORead the docs