Summary
httpd
[2.4.53-7.0.1.5]
- Replace index.html with Oracle's index page oracle_index.html.
[2.4.53-7.5]
- Resolves: #2177751 - CVE-2023-25690 httpd: HTTP request splitting with
mod_rewrite and mod_proxy
mod_http2
[1.15.19-3.5]
- Resolves: #2177751 - CVE-2023-25690 httpd: HTTP request splitting with
mod_rewrite and mod_proxy
[1.15.19-3]
- Resolves: #2066311 - CVE-2021-44224 httpd: possible NULL dereference or SSRF
in forward proxy configurations
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | httpd | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | httpd-core | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | httpd-devel | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | httpd-filesystem | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | httpd-manual | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | httpd-tools | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | mod_http2 | 0:1.15.19-3.el9_1.5 |
| Oracle Linux · 9 | mod_ldap | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | mod_lua | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | mod_proxy_html | 1:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | mod_session | 0:2.4.53-7.0.1.el9_1.5 |
| Oracle Linux · 9 | mod_ssl | 1:2.4.53-7.0.1.el9_1.5 |
Vulnerabilities 1
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…