Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 security update

Fixed packages 31

Vulnerabilities 2

• High 7.3
  CVE-2023-38709 Public exploit

  Apache HTTP Server: HTTP response splitting

  Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Apr 4, 2024
• Medium 5.9
  CVE-2024-46544

  Apache Tomcat Connectors: mod_jk: local users can view and modify configuration

  Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Con…

  Apache Software Foundation Apache Tomcat Connectors libapache-mod-jk libapache-mod-jk Debian Ubuntu
  Sep 23, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.57/html/red_hat_jboss_core_services_apache_http_server_2.4.57_service_pack_6_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273491
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2314194
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6927.json
• report
  https://access.redhat.com/security/cve/CVE-2023-38709
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-38709
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-38709
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-38709
• report
  https://access.redhat.com/security/cve/CVE-2024-46544
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-46544
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-46544
• article
  https://lists.apache.org/thread/q1gp7cc38hs1r8gj8gfnopwznd5fpr4d