Moderate: httpd security and bug fix update
Summary
ALSA-2023:0970: Moderate: httpd security and bug fix update. Affects httpd versions < 2.4.53-7.el9_1.1. Fixed in 2.4.53-7.el9_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Vulnerability Detail
This vulnerability affects the httpd package and includes the following security issues:
- CVE-2006-20001: mod_dav out-of-bounds read/write of zero byte
- CVE-2022-36760: mod_proxy_ajp possible request smuggling
- CVE-2022-37436: mod_proxy HTTP response splitting
These vulnerabilities can lead to various security risks, including unauthorized access, information disclosure, and potential request manipulation.
How To Fix
Minimum fixed version
2.4.53-7.el9_1.1
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to update the httpd package to address these vulnerabilities and ensure the security of your web server. If you need further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for httpd →
FAQ
These vulnerabilities can allow attackers to gain unauthorized access, manipulate requests, and potentially disclose sensitive information.
At the time of this advisory, there are no known exploits for these vulnerabilities.
No specific workaround is mentioned for these vulnerabilities. It is recommended to update to the latest version of the httpd package.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will provide real-time alerts for open-source vulnerabilities.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related details, on the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
