Moderate: httpd:2.4/httpd security update
Summary
ALSA-2024:4197: Moderate: httpd:2.4/httpd security update. Affects httpd versions < 2.4.37-65.module_el8.10.0+3860+a6e26e50. Fixed in 2.4.37-65.module_el8.10.0+3860+a6e26e50. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used to serve web content and handle HTTP requests. The vulnerability affects the httpd package in AlmaLinux 8.
Vulnerability Detail
The vulnerability in httpd:2.4 allows for HTTP response splitting, which can lead to various security issues. An attacker can manipulate the HTTP response headers to inject malicious content or perform cross-site scripting attacks. This can result in unauthorized access, data leakage, or the execution of arbitrary code.
How To Fix
Minimum fixed version
2.4.37-65.module_el8.10.0+3860+a6e26e50
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the security update as soon as possible.
Conclusion
The httpd:2.4/httpd security update addresses a moderate vulnerability that allows for HTTP response splitting. It is crucial to update the httpd package to the recommended version to mitigate the risk of unauthorized access, data leakage, or code execution.
See every vulnerability recorded for httpd →
FAQ
The vulnerability allows attackers to manipulate HTTP response headers, potentially leading to unauthorized access, data leakage, or code execution.
You can use Vulert playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
There are no known public exploits for this vulnerability at the moment. However, it is important to apply the security update to prevent any potential attacks.
It is recommended to update the httpd package using the provided security update. Manual patching may not address all aspects of the vulnerability and could lead to incomplete mitigation.
For more details about the vulnerability, including the impact, CVSS score, and acknowledgments, refer to the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
