apache http server 2.4.8 vulnerabilities and exploits

(subscribe to this query)

In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnera...

Apache Http Server 2.4.0 Apache Http Server 2.4.1 Apache Http Server 2.4.2 Apache Http Server 2.4.3 Apache Http Server 2.4.6 Apache Http Server 2.4.7 Apache Http Server 2.4.8 Apache Http Server 2.4.9 Apache Http Server 2.4.10 Apache Http Server 2.4.12 Apache Http Server 2.4.14 Apache Http Server 2.4.16

1 EDB exploit

In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.

Apache Http Server 2.4.0 Apache Http Server 2.4.1 Apache Http Server 2.4.2 Apache Http Server 2.4.3 Apache Http Server 2.4.6 Apache Http Server 2.4.7 Apache Http Server 2.4.8 Apache Http Server 2.4.9 Apache Http Server 2.4.10 Apache Http Server 2.4.12 Apache Http Server 2.4.14 Apache Http Server 2.4.16

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server prior to 2.4.8 allows remote malicious users to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

Apache Http Server Oracle Http Server 10.1.3.5.0 Oracle Http Server 11.1.1.7.0 Oracle Http Server 12.1.2.0 Oracle Http Server 12.1.3.0 Oracle Secure Global Desktop 4.63 Oracle Secure Global Desktop 4.71 Oracle Secure Global Desktop 5.0 Oracle Secure Global Desktop 5.1 Canonical Ubuntu Linux 10.04 Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 12.10

HttpObjectDecoder.java in Netty prior to 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Netty Netty Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 33 Canonical Ubuntu Linux 18.04 Redhat Jboss Amq Clients 2 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Apache Spark 2.4.7 Apache Spark 2.4.8

zlib up to and including 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may...

Zlib Zlib Fedoraproject Fedora 35 Fedoraproject Fedora 36 Fedoraproject Fedora 37 Debian Debian Linux 10.0 Netapp Active Iq Unified Manager -Netapp Hci -Netapp Management Services For Element Software -Netapp Oncommand Workflow Automation -Netapp Ontap Select Deploy Administration Utility -Netapp Storagegrid -Netapp Hci Compute Node -

5 Github repositories

libexpat prior to 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Libexpat Project Libexpat Debian Debian Linux 10.0 Debian Debian Linux 11.0 Fedoraproject Fedora 35 Fedoraproject Fedora 36 Fedoraproject Fedora 37

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook