Description
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.2.9-1 | — |
| Debian 13 | apache2 | 2.2.9-1 | — |
| Debian 12 | apache2 | 2.2.9-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.10-1.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.10-1.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | mysql +6 | 5.0.60sp1-1.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | mysql-connector-odbc | 3.51.26r1127-1.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | perl-DBD-MySQL | 4.008-2.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | perl-DBD-Pg | 1.49-4.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | perl-DBI | 1.607-3.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | php-pear | 1:1.7.2-2.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | postgresql +11 | 8.2.11-1.el5s2 | RHSA-2008:0966 |
| Red Hat Rhel Application Stack 2 | postgresqlclient81 | 8.1.14-1.el5s2 | RHSA-2008:0966 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 | openSUSE-SU-2024:10623-1 |
Advisories 2
- RHSA-2008:0966 Red Hat Security Advisory: Red Hat Application Stack v2.2 security and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 34219 third-party-advisory
- 31026 third-party-advisory
- 3523 third-party-advisory
- SUSE-SR:2008:024 vendor-advisory
- 31681 vdb-entry
- 27236 vdb-entry
- USN-731-1 vendor-advisory
- ADV-2009-0320 vdb-entry
- 32222 third-party-advisory
- RHSA-2008:0966 vendor-advisory
- 33797 third-party-advisory
- 20080729 rPSA-2008-0236-1 httpd mod_ssl mailing-list
- 20080110 SecurityReason - Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vulnerability mailing-list
- GLSA-200807-06 vendor-advisory
- ADV-2008-2780 vdb-entry
- HPSBUX02401 vendor-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- oval:org.mitre.oval:def:8371 vdb-entry signature
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [5/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list