Red Hat Security Advisory

RHSA-2024:6928

Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 security update

Released 2024-09-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Core Services

Fixes 4 records

TI-2024-25713 CVE-2024-38472 · GHSA-fjcc-r94c-wxr8

Apache HTTP Server on WIndows UNC SSRF

HIGH 78

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.6947 Published 2024-07-01 Partial fix CWE-918

TI-2024-27262 CVE-2024-40898 · GHSA-f6mg-hq7f-jw2j

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

MEDIUM 51

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01628 Published 2024-07-18 Partial fix CWE-918

TI-2023-20055 CVE-2023-38709 · GHSA-9fvf-9v35-97qv

Apache HTTP Server: HTTP response splitting

LOW 39

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.03914 Published 2024-04-04 Partial fix CWE-1284

TI-2024-31014 CVE-2024-46544 · GHSA-2582-53pq-96cq

Apache Tomcat Connectors: mod_jk: local users can view and modify configuration

LOW 26

Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of servic…

CVSS 3.1MEDIUM 5.9 Local No auth No interaction EPSS 0.00326 Published 2024-09-23 Fixed CWE-276