Description
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache HTTP Server
Default version status: unaffected
2.4.0 to ≤ 2.4.58affected
References
- https://httpd.apache.org/security/vulnerabilities_24.html ↗
- https://security.netapp.com/advisory/ntap-20240415-0013/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNV4SZAPVS43DZWNFU7XBYYOZEZMI4ZC/ ↗
- http://www.openwall.com/lists/oss-security/2024/04/04/5 ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ/ ↗
- https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html ↗
- https://lists.debian.org/debian-lts-announce/2024/05/msg00014.html ↗
- https://support.apple.com/kb/HT214119 ↗
- http://seclists.org/fulldisclosure/2024/Jul/18 ↗