Affected: AlmaLinux:9: mod_http2
The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.
Security Fix(es):
* mod_http2: DoS by null pointer in websocket over HTTP/2 (CVE-2024-36387)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected: Alpaquita:23: apache2, Alpaquita:stream: apache2
Affected: Bitnami: apache
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Affected: openEuler:24.03-LTS: mod_http2
Mod_h[ttp]2 is an official Apache httpd module, first released in 2.4.17. See Apache downloads to get a released version. mod_proxy_h[ttp]2 has been released in 2.4.23. Security Fix(es): Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.(CVE-2024-36387)
apache2-2.4.61-1.1 on GA media
openssl: SSL_select_next_proto buffer overread httpd: HTTP Response Splitting in multiple modules mod_http2: DoS by null pointer in websocket over HTTP/2
Security update for apache2
Affected: Ubuntu:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.