Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | httpd | 0:2.4.37-51.module+el8.7.0+1059+126e9251 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-5.module+el8.6.0+823+f143cee1 |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e |
Vulnerabilities 1
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2176209