Red Hat Security Advisory

RHSA-2024:9306

httpd security update

Released 2024-11-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) httpd-2.4.62-1.el9, httpd-core-2.4.62-1.el9, httpd-devel-2.4.62-1.el9 +8

Fixes 2 records

TI-2023-20055 CVE-2023-38709 · GHSA-9fvf-9v35-97qv

Apache HTTP Server: HTTP response splitting

LOW 39

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.03914 Published 2024-04-04 Partial fix CWE-1284

TI-2024-16312 CVE-2024-24795 · GHSA-c4ch-cv96-r58v

Apache HTTP Server: HTTP Response Splitting in multiple modules

LOW 33

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.02874 Published 2024-04-04 Partial fix CWE-113