RHSA-2023:1672 — Red Hat Security Advisory: httpd:2.4 security update

Fixed packages 66

Release	Package	Fixed in
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	httpd	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	httpd-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	httpd-debugsource	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	httpd-devel	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	httpd-filesystem	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	httpd-manual	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	httpd-tools	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	httpd-tools-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_http2	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_http2-debuginfo	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_http2-debugsource	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_ldap	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_ldap-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_md	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_md-debuginfo	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_md-debugsource	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_proxy_html	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_proxy_html-debuginfo	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_session	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_session-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_ssl	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream	mod_ssl-debuginfo	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	httpd	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	httpd-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	httpd-debugsource	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	httpd-devel	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	httpd-filesystem	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	httpd-manual	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	httpd-tools	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	httpd-tools-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_http2	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_http2-debuginfo	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_http2-debugsource	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_ldap	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_ldap-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_md	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_md-debuginfo	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_md-debugsource	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_proxy_html	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_proxy_html-debuginfo	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_session	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_session-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_ssl	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 E4S rhel_e4s:8.2::appstream	mod_ssl-debuginfo	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	httpd	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	httpd-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	httpd-debugsource	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	httpd-devel	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	httpd-filesystem	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	httpd-manual	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	httpd-tools	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	httpd-tools-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_http2	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_http2-debuginfo	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_http2-debugsource	0:1.11.3-3.module+el8.2.0+18513+b6a58d46.3
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_ldap	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_ldap-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_md	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_md-debuginfo	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_md-debugsource	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_proxy_html	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_proxy_html-debuginfo	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_session	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_session-debuginfo	0:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_ssl	1:2.4.37-21.module+el8.2.0+18510+68528e70.6
Red Hat · RHEL 8.2 TUS rhel_tus:8.2::appstream	mod_ssl-debuginfo	1:2.4.37-21.module+el8.2.0+18510+68528e70.6

Vulnerabilities 1

Critical 9.8

CVE-2023-25690 Public exploit EPSS 84%

Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Mar 7, 2023

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2176209
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1672.json
report
https://access.redhat.com/security/cve/CVE-2023-25690
advisory
https://www.cve.org/CVERecord?id=CVE-2023-25690
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-25690
article
https://httpd.apache.org/security/vulnerabilities_24.html

Red Hat Security Advisory: httpd:2.4 security update

Fixed packages 66

Vulnerabilities 1

Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

References