apache http server 2.4.37 vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Apache Http Server 2.4.37 Apache Http Server 2.4.38 Fedoraproject Fedora 29 Fedoraproject Fedora 30

5.3

CVSSv3

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

2 Github repositories

6.1

CVSSv3

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

Apache Http Server

1 EDB exploit

7.2

CVSSv3

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only b...

5.4

CVSSv3

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-e...

Redhat Jboss Core Services Httpd 2.4.37

7.5

CVSSv3

HTTP/2 (2.4.20 up to and including 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, ...

Apache Http Server Debian Debian Linux 9.0 Debian Debian Linux 10.0

5.3

CVSSv3

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

Apache Http Server Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10 Debian Debian Linux 9.0

9.1

CVSSv3

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

Apache Http Server Oracle Retail Xstore Point Of Service 7.1 Oracle Http Server 12.2.1.3.0 Oracle Enterprise Manager Ops Center 12.3.3 Oracle Enterprise Manager Ops Center 12.4.0 Oracle Instantis Enterprisetrack Oracle Communications Element Manager 8.2.0 Oracle Communications Element Manager 8.1.1 Oracle Communications Element Manager 8.1.0 Oracle Communications Element Manager 8.0.0 Oracle Http Server 12.2.1.4.0 Oracle Enterprise Manager Ops Center 12.4.0.0

9.8

CVSSv3

Apache HTTP Server 2.4.52 and previous versions fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Apache Http Server Fedoraproject Fedora 34 Fedoraproject Fedora 35 Fedoraproject Fedora 36 Debian Debian Linux 9.0 Oracle Http Server 12.2.1.3.0 Oracle Http Server 12.2.1.4.0 Oracle Enterprise Manager Ops Center 12.4.0.0 Oracle Zfs Storage Appliance Kit 8.8 Apple Macos Apple Mac Os X 10.15.7

7.5

CVSSv3

A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSS...

Apache Http Server 2.4.37 Oracle Retail Xstore Point Of Service 7.1 Oracle Retail Xstore Point Of Service 7.0 Oracle Hospitality Guest Access 4.2.0 Oracle Hospitality Guest Access 4.2.1 Oracle Enterprise Manager Ops Center 12.3.3 Oracle Instantis Enterprisetrack 17.1 Oracle Instantis Enterprisetrack 17.2 Oracle Instantis Enterprisetrack 17.3

2 Github repositories

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook