Read the docs
TI-2011-03212 Aliases CVE-2011-3639GHSA-rqg3-pfxx-wwq3

The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before…

Priority MEDIUM 51CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.

Why it matters now

EPSS 0.49697 98th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 76

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.0.11:*:*:*:*:*:*:*2.0.11VulnerableApache
cpe:2.3:a:apache:http_server:2.0.12:*:*:*:*:*:*:*2.0.12VulnerableApache
cpe:2.3:a:apache:http_server:2.0.13:*:*:*:*:*:*:*2.0.13VulnerableApache
cpe:2.3:a:apache:http_server:2.0.14:*:*:*:*:*:*:*2.0.14VulnerableApache
cpe:2.3:a:apache:http_server:2.0.15:*:*:*:*:*:*:*2.0.15VulnerableApache
cpe:2.3:a:apache:http_server:2.0.16:*:*:*:*:*:*:*2.0.16VulnerableApache
cpe:2.3:a:apache:http_server:2.0.17:*:*:*:*:*:*:*2.0.17VulnerableApache
cpe:2.3:a:apache:http_server:2.0.18:*:*:*:*:*:*:*2.0.18VulnerableApache
cpe:2.3:a:apache:http_server:2.0.19:*:*:*:*:*:*:*2.0.19VulnerableApache
cpe:2.3:a:apache:http_server:2.0.20:*:*:*:*:*:*:*2.0.20VulnerableApache
  • cpe:2.3:a:apache:http_server:2.0.11:*:*:*:*:*:*:* Versions 2.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.12:*:*:*:*:*:*:* Versions 2.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.13:*:*:*:*:*:*:* Versions 2.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.14:*:*:*:*:*:*:* Versions 2.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.15:*:*:*:*:*:*:* Versions 2.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.16:*:*:*:*:*:*:* Versions 2.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.17:*:*:*:*:*:*:* Versions 2.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.18:*:*:*:*:*:*:* Versions 2.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.19:*:*:*:*:*:*:* Versions 2.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.20:*:*:*:*:*:*:* Versions 2.0.20 Vulnerable ·Apache
Show 66 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.0.21:*:*:*:*:*:*:*2.0.21VulnerableApache
cpe:2.3:a:apache:http_server:2.0.22:*:*:*:*:*:*:*2.0.22VulnerableApache
cpe:2.3:a:apache:http_server:2.0.23:*:*:*:*:*:*:*2.0.23VulnerableApache
cpe:2.3:a:apache:http_server:2.0.24:*:*:*:*:*:*:*2.0.24VulnerableApache
cpe:2.3:a:apache:http_server:2.0.25:*:*:*:*:*:*:*2.0.25VulnerableApache
cpe:2.3:a:apache:http_server:2.0.26:*:*:*:*:*:*:*2.0.26VulnerableApache
cpe:2.3:a:apache:http_server:2.0.27:*:*:*:*:*:*:*2.0.27VulnerableApache
cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*2.0.28VulnerableApache
cpe:2.3:a:apache:http_server:2.0.29:*:*:*:*:*:*:*2.0.29VulnerableApache
cpe:2.3:a:apache:http_server:2.0.30:*:*:*:*:*:*:*2.0.30VulnerableApache
cpe:2.3:a:apache:http_server:2.0.31:*:*:*:*:*:*:*2.0.31VulnerableApache
cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*2.0.32VulnerableApache
cpe:2.3:a:apache:http_server:2.0.33:*:*:*:*:*:*:*2.0.33VulnerableApache
cpe:2.3:a:apache:http_server:2.0.34:*:*:*:*:*:*:*2.0.34VulnerableApache
cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*2.0.35VulnerableApache
cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*2.0.36VulnerableApache
cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*2.0.37VulnerableApache
cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*2.0.38VulnerableApache
cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*2.0.39VulnerableApache
cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*2.0.40VulnerableApache
cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*2.0.41VulnerableApache
cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*2.0.42VulnerableApache
cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*2.0.43VulnerableApache
cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*2.0.44VulnerableApache
cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*2.0.45VulnerableApache
cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*2.0.46VulnerableApache
cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*2.0.47VulnerableApache
cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*2.0.48VulnerableApache
cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*2.0.49VulnerableApache
cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*2.0.50VulnerableApache
cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*2.0.51VulnerableApache
cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*2.0.52VulnerableApache
cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*2.0.53VulnerableApache
cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*2.0.54VulnerableApache
cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*2.0.55VulnerableApache
cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*2.0.56VulnerableApache
cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*2.0.57VulnerableApache
cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*2.0.58VulnerableApache
cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*2.0.59VulnerableApache
cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*2.0.61VulnerableApache
cpe:2.3:a:apache:http_server:2.0.63:*:*:*:*:*:*:*2.0.63VulnerableApache
cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableApache
cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableApache
cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableApache
cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableApache
cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableApache
cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableApache
cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*2.2.9VulnerableApache
cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*2.2.10VulnerableApache
cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*2.2.11VulnerableApache
cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*2.2.12VulnerableApache
cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*2.2.13VulnerableApache
cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*2.2.14VulnerableApache
cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*2.2.15VulnerableApache
cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*2.2.16VulnerableApache
cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:*2.2.17VulnerableApache
cpe:2.3:a:apache:http_server2.0a1:*:*:*:*:*:*:*:*all versionsVulnerableApache
cpe:2.3:a:apache:http_server2.0a2:*:*:*:*:*:*:*:*all versionsVulnerableApache
cpe:2.3:a:apache:http_server2.0a3:*:*:*:*:*:*:*:*all versionsVulnerableApache
cpe:2.3:a:apache:http_server2.0a4:*:*:*:*:*:*:*:*all versionsVulnerableApache
cpe:2.3:a:apache:http_server2.0a5:*:*:*:*:*:*:*:*all versionsVulnerableApache
cpe:2.3:a:apache:http_server2.0a6:*:*:*:*:*:*:*:*all versionsVulnerableApache
cpe:2.3:a:apache:http_server2.0a7:*:*:*:*:*:*:*:*all versionsVulnerableApache
cpe:2.3:a:apache:http_server2.0a8:*:*:*:*:*:*:*:*all versionsVulnerableApache
cpe:2.3:a:apache:http_server2.0a9:*:*:*:*:*:*:*:*all versionsVulnerableApache
  • cpe:2.3:a:apache:http_server:2.0.21:*:*:*:*:*:*:* Versions 2.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.22:*:*:*:*:*:*:* Versions 2.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.23:*:*:*:*:*:*:* Versions 2.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.24:*:*:*:*:*:*:* Versions 2.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.25:*:*:*:*:*:*:* Versions 2.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.26:*:*:*:*:*:*:* Versions 2.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.27:*:*:*:*:*:*:* Versions 2.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:* Versions 2.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.29:*:*:*:*:*:*:* Versions 2.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.30:*:*:*:*:*:*:* Versions 2.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.31:*:*:*:*:*:*:* Versions 2.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:* Versions 2.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.33:*:*:*:*:*:*:* Versions 2.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.34:*:*:*:*:*:*:* Versions 2.0.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:* Versions 2.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:* Versions 2.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:* Versions 2.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:* Versions 2.0.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:* Versions 2.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:* Versions 2.0.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:* Versions 2.0.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:* Versions 2.0.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:* Versions 2.0.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:* Versions 2.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:* Versions 2.0.45 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:* Versions 2.0.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:* Versions 2.0.47 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:* Versions 2.0.48 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:* Versions 2.0.49 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:* Versions 2.0.50 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:* Versions 2.0.51 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:* Versions 2.0.52 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:* Versions 2.0.53 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:* Versions 2.0.54 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:* Versions 2.0.55 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:* Versions 2.0.56 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:* Versions 2.0.57 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:* Versions 2.0.58 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:* Versions 2.0.59 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:* Versions 2.0.61 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.0.63:*:*:*:*:*:*:* Versions 2.0.63 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:* Versions 2.2.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:* Versions 2.2.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:* Versions 2.2.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:* Versions 2.2.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:* Versions 2.2.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:* Versions 2.2.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:* Versions 2.2.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a1:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a2:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a3:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a4:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a5:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a6:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a7:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a8:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server2.0a9:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache

Remediation

Red Hat 2 advisories

  • RHSA-2012:0323 Released 2012-02-21 · Red Hat rating Moderate
    httpd security update
    • RHEL Desktop Workstation (v. 5 client) httpd-2.2.3-63.el5_8.1, httpd-devel-2.2.3-63.el5_8.1, httpd-devel-2.2.3-63.el5_8.1.i386 +2
    • Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-63.el5_8.1, httpd-2.2.3-63.el5_8.1.i386, httpd-2.2.3-63.el5_8.1.ia64 +13
    • Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-63.el5_8.1, httpd-2.2.3-63.el5_8.1.i386, mod_ssl-1:2.2.3-63.el5_8.1 +1
  • RHSA-2012:0128 Released 2012-02-13 · Red Hat rating Moderate
    httpd security update
    • Red Hat Enterprise Linux Desktop (v. 6) httpd-2.2.15-15.el6_2.1, httpd-tools-2.2.15-15.el6_2.1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) httpd-2.2.15-15.el6_2.1, httpd-devel-2.2.15-15.el6_2.1, httpd-manual-2.2.15-15.el6_2.1 +1
    • Red Hat Enterprise Linux HPC Node (v. 6) httpd-2.2.15-15.el6_2.1, httpd-tools-2.2.15-15.el6_2.1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd-2.2.15-15.el6_2.1, httpd-devel-2.2.15-15.el6_2.1, httpd-manual-2.2.15-15.el6_2.1 +1
    • Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-15.el6_2.1, httpd-devel-2.2.15-15.el6_2.1, httpd-devel-2.2.15-15.el6_2.1.ppc +3
    • Red Hat Enterprise Linux Workstation (v. 6) httpd-2.2.15-15.el6_2.1, httpd-devel-2.2.15-15.el6_2.1, httpd-manual-2.2.15-15.el6_2.1 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 4AffectedNo fix planned: Will not fix
RHEL Desktop Workstation (v. 5 client)Fixed RHSA-2012:0323
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2012:0323
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2012:0323
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2012:0128
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2012:0128
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2012:0128
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2012:0128
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2012:0128
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2012:0128
Not affected: 2 products
  • Red Hat Directory Server 8
  • Red Hat JBoss Enterprise Web Server 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-3639
  2. 2026-10-03 Alias added: GHSA-rqg3-pfxx-wwq3

References

Advisory 2

Other 2

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences