Most recent entries from all

ALSA-2024:4197 — Moderate: httpd:2.4/httpd security update

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd:2.4: httpd: HTTP response splitting (CVE-2023-38709)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-03101

BELL-CVE-2023-38709

Affected: Alpaquita:23: apache2, Alpaquita:stream: apache2

BIT-apache-2023-38709 — Apache HTTP Server: HTTP response splitting

Affected: Bitnami: apache

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.

This issue affects Apache HTTP Server: through 2.4.58.

certfr-2024-avi-0274 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Elles permettent à…

certfr-2024-avi-0274

cnvd-2024-36395

EUVD-2026-259912

fkie_cve-2023-38709

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.

This issue affects Apache HTTP Server: through 2.4.58.

GHSA-9fvf-9v35-97qv

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.

This issue affects Apache HTTP Server: through 2.4.58.

gsd-2023-38709

ICSA-24-319-04 — Siemens SINEC NMS

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC alg…

msrc_CVE-2023-38709 — Apache HTTP Server: HTTP response splitting

msrc_CVE-2023-38709

OESA-2024-1553 — httpd security update

Affected: openEuler:20.03-LTS-SP1: httpd, openEuler:20.03-LTS-SP4: httpd, openEuler:22.03-LTS: httpd, openEuler:22.03-LTS-SP1: httpd, openEuler:22.03-LTS-SP2: httpd, openEuler:22.03-LTS-SP3: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. (CVE-2023-38709) HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.(CVE-2024-24795) HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.(CVE-2024-27316)

RHSA-2024:4197 — Red Hat Security Advisory: httpd:2.4/httpd security update

httpd: HTTP response splitting

RHSA-2024:6927 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 security update

httpd: HTTP response splitting mod_jk: information Disclosure / DoS

SUSE-SU-2024:1627-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2023-38709

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

WID-SEC-W-2024-0801 — Apache HTTP Server: Mehrere Schwachstellen ermöglichen Manipulation von Daten

Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um Daten zu manipulieren.