Important: httpd and mod_http2 security update
Summary
ALSA-2023:1670: Important: httpd and mod_http2 security update. Affects httpd versions < 2.4.53-7.el9_1.5. Fixed in 2.4.53-7.el9_1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used to serve web content and applications.
Vulnerability Detail
This security update addresses an important vulnerability in the Apache HTTP Server (httpd) and the mod_http2 module. The vulnerability, identified as CVE-2023-25690, allows for HTTP request splitting when using mod_rewrite and mod_proxy. This could potentially lead to various attacks, such as HTTP response splitting, cache poisoning, and cross-site scripting (XSS). The impact of this vulnerability can be severe, as it may allow an attacker to manipulate HTTP requests and responses, leading to unauthorized access or data leakage.
How To Fix
Minimum fixed version
2.4.53-7.el9_1.5
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the httpd and mod_http2 packages to address this vulnerability. Failure to do so may expose your web server to potential attacks and unauthorized access. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httpd →
FAQ
The Apache HTTP Server is a widely used web server software that delivers web content and applications.
mod_rewrite is an Apache module that provides URL rewriting capabilities, while mod_proxy is a module that enables proxying requests to other servers. Both modules are commonly used with the Apache HTTP Server.
HTTP request splitting is a technique where an attacker manipulates the HTTP request to inject additional headers or data, potentially leading to various attacks such as cache poisoning, HTTP response splitting, or cross-site scripting (XSS).
The vulnerability allows for HTTP request splitting, which can lead to unauthorized access, data leakage, cache poisoning, or XSS attacks. It is important to update the affected packages to mitigate these risks.
To update the httpd and mod_http2 packages, follow the package update process specific to your operating system or package manager. Ensure that all instances of httpd and mod_http2 are updated to version 2.4.53-7.el9_1.5 or later.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
