Apache2 - Regression Update
Summary
DSA-3325-2: apache2 - regression update. Affects apache2 versions < 2.2.22-13+deb7u6. Fixed in 2.2.22-13+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software that provides a secure and efficient platform for serving web content. It is a critical component in many web hosting environments and powers a significant portion of websites on the internet. However, several vulnerabilities have been discovered in the Apache HTTPD server, which require immediate attention to ensure the security and integrity of web applications.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-3183, allows for an HTTP request smuggling attack due to a bug in parsing chunked requests. This flaw could be exploited by a malicious client to manipulate the request length, potentially leading to cache poisoning or credential hijacking if an intermediary proxy is in use. The second vulnerability, CVE-2015-3185, is a design error in the ap_some_auth_required function, rendering the API unusable in Apache2 2.4.x. This could result in modules allowing access when they should not. The fix backports the new ap_some_authn_required API from version 2.4.16.
How To Fix
Minimum fixed version
2.2.22-13+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to apply the recommended package upgrades to ensure the security of the Apache2 server.
Conclusion
It is highly recommended to upgrade the Apache2 package to the fixed versions mentioned above to address the identified vulnerabilities. Failure to do so may expose your web applications to potential attacks and compromise the security of your server. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
CVE-2015-3183 allows for an HTTP request smuggling attack, which can lead to cache poisoning or credential hijacking if an intermediary proxy is in use.
You can check the version of Apache2 by running the command 'apache2 -v' in the terminal.
No, CVE-2015-3185 only affects Apache2 2.4.x versions. The older versions are not impacted.
There are no known exploits for these vulnerabilities at the moment. However, it is crucial to apply the recommended fixes to mitigate any potential risks.
Yes, the updated Apache2 package allows for the configuration of custom Diffie-Hellman (DH) parameters.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
