Summary
httpd
[2.4.37-47.0.2.2]
- mod_proxy: ap_proxy_http_request() to clear hop-by-hop first and
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | httpd | 0:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
| Oracle Linux · 8 | httpd-devel | 0:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
| Oracle Linux · 8 | httpd-filesystem | 0:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
| Oracle Linux · 8 | httpd-manual | 0:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
| Oracle Linux · 8 | httpd-tools | 0:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
| Oracle Linux · 8 | mod_http2 | 0:1.15.7-5.module+el8.6.0+20548+01710940 |
| Oracle Linux · 8 | mod_ldap | 0:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
| Oracle Linux · 8 | mod_md | 1:2.0.8-8.module+el8.5.0+20475+4f6a8fd5 |
| Oracle Linux · 8 | mod_proxy_html | 1:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
| Oracle Linux · 8 | mod_session | 0:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
| Oracle Linux · 8 | mod_ssl | 1:2.4.37-47.0.2.module+el8.6.0+20724+119b489d.2 |
Vulnerabilities 1
-
Unscored —CVE-2022-31813 Public exploit
mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.