CVE-2024-24795
Published: April 5, 2024Last modified: April 15, 2024
Description
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.3 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality | LOW |
| Integrity impact | LOW |
| Availability impact | LOW |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | apache2 | Fixed (2.4.59-r0) |
| Stream | apache2 | Fixed (2.4.59-r0) |
References
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://www.openwall.com/lists/oss-security/2024/04/04/5
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html
- https://lists.debian.org/debian-lts-announce/2024/05/msg00014.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WNV4SZAPVS43DZWNFU7XBYYOZEZMI4ZC/
- https://security.netapp.com/advisory/ntap-20240415-0013/
- https://support.apple.com/kb/HT214119