apache http server 2.4.38 vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Apache Http Server 2.4.37 Apache Http Server 2.4.38 Fedoraproject Fedora 29 Fedoraproject Fedora 30

7.2

CVSSv3

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only b...

5.3

CVSSv3

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

2 Github repositories

6.1

CVSSv3

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

Apache Http Server

1 EDB exploit

7.5

CVSSv3

HTTP/2 (2.4.20 up to and including 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, ...

Apache Http Server Debian Debian Linux 9.0 Debian Debian Linux 10.0

7.5

CVSSv3

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status...

Apache Http Server 1.15.17 Apache Http Server 2.4.47 Fedoraproject Fedora 33 Fedoraproject Fedora 34 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Oracle Instantis Enterprisetrack 17.1 Oracle Instantis Enterprisetrack 17.2 Oracle Instantis Enterprisetrack 17.3 Oracle Enterprise Manager Ops Center 12.4.0.0 Oracle Zfs Storage Appliance Kit 8.8

5.3

CVSSv3

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

Apache Http Server Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10 Debian Debian Linux 9.0

9.1

CVSSv3

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

Apache Http Server Oracle Retail Xstore Point Of Service 7.1 Oracle Http Server 12.2.1.3.0 Oracle Enterprise Manager Ops Center 12.3.3 Oracle Enterprise Manager Ops Center 12.4.0 Oracle Instantis Enterprisetrack Oracle Communications Element Manager 8.2.0 Oracle Communications Element Manager 8.1.1 Oracle Communications Element Manager 8.1.0 Oracle Communications Element Manager 8.0.0 Oracle Http Server 12.2.1.4.0 Oracle Enterprise Manager Ops Center 12.4.0.0

7.8

CVSSv3

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent ...

Apache Http Server Fedoraproject Fedora 29 Fedoraproject Fedora 30 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10 Debian Debian Linux 9.0 Opensuse Leap 42.3 Opensuse Leap 15.0

1 EDB exploit7 Github repositories1 Article

8.2

CVSSv3

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server ...

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook