Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | httpd | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | httpd-core | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | httpd-devel | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | httpd-filesystem | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | httpd-manual | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | httpd-tools | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | mod_http2 | 1.15.19-3.el9_1.5 |
| AlmaLinux · 9 | mod_ldap | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | mod_lua | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | mod_proxy_html | 1:2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | mod_session | 2.4.53-7.el9_1.5 |
| AlmaLinux · 9 | mod_ssl | 1:2.4.53-7.el9_1.5 |
Vulnerabilities 1
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…