Moderate: httpd:2.4 security update
Summary
ALSA-2024:3121: Moderate: httpd:2.4 security update. Affects httpd versions < 2.4.37-64.module_el8.10.0+3761+75f8c656. Fixed in 2.4.37-64.module_el8.10.0+3761+75f8c656. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Vulnerability Detail
The Apache HTTP Server (httpd) is affected by two security vulnerabilities:
-
mod_macro: out-of-bounds read vulnerability (CVE-2023-31122) This vulnerability allows an attacker to read data beyond the bounds of an array, potentially leading to information disclosure or a denial of service.
-
mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802) This vulnerability allows an attacker to exhaust memory by sending specially crafted reset requests, potentially leading to a denial of service.
These vulnerabilities can have a moderate impact on the security and stability of the Apache HTTP Server.
How To Fix
Minimum fixed version
2.4.37-64.module_el8.10.0+3761+75f8c656
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
To ensure the security and stability of your Apache HTTP Server, it is highly recommended to update the httpd package to the latest version. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httpd →
FAQ
These vulnerabilities can potentially lead to information disclosure or a denial of service.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
At the time of this advisory, there are no known exploits for these vulnerabilities.
There is no specific workaround available for these vulnerabilities. It is recommended to update the httpd package to the latest version.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
