Description
mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.2.8-1 | — |
| Debian 13 | apache2 | 2.2.8-1 | — |
| Debian 12 | apache2 | 2.2.8-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | httpd +2 | 2.2.3-11.el5_1.3 | RHSA-2008:0008 |
| RHEL 5 | mod_ssl | 1:2.2.3-11.el5_1.3 | RHSA-2008:0008 |
| RHEL 4 | httpd +3 | 2.0.52-38.ent.2 | RHSA-2008:0006 |
| RHEL 4 | mod_ssl | 1:2.0.52-38.ent.2 | RHSA-2008:0006 |
| RHEL 3 | httpd +1 | 2.0.46-70.ent | RHSA-2008:0005 |
| RHEL 3 | mod_ssl | 1:2.0.46-70.ent | RHSA-2008:0005 |
| RHEL 2 | apache +2 | 1.3.27-14.ent | RHSA-2008:0004 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.4-9.el5s2 | RHSA-2008:0009 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.4-9.el5s2 | RHSA-2008:0009 |
| Red Hat Rhel Application Stack 1 | httpd +2 | 2.0.59-1.el4s1.10 | RHSA-2008:0007 |
| Red Hat Rhel Application Stack 1 | mod_ssl | 1:2.0.59-1.el4s1.10 | RHSA-2008:0007 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 | openSUSE-SU-2024:10623-1 |
Advisories 8
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0008 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0006 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0004 Red Hat Security Advisory: apache security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0005 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2008:0009 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0007 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2008:0005 vendor-advisory
- GLSA-200803-19 vendor-advisory
- 28749 third-party-advisory
- HPSBUX02465 vendor-advisory
- 3526 third-party-advisory
- SSRT090085 vendor-advisory
- 20080110 SecurityReason - Apache (mod_proxy_ftp) Undefined Charset UTF-7 XSS Vulnerability mailing-list
- SSRT090208 vendor-advisory
- 20080110 Apache (mod_proxy_ftp) Undefined Charset UTF-7 XSS Vulnerability third-party-advisory
- FEDORA-2008-1695 vendor-advisory
- 27234 vdb-entry
- apache-modproxyftp-utf7-xss(39615) vdb-entry
- 28526 third-party-advisory
- RHSA-2008:0006 vendor-advisory
- ADV-2008-0924 vdb-entry
- RHSA-2008:0007 vendor-advisory
- oval:org.mitre.oval:def:10812 vdb-entry signature
- 1019185 vdb-entry
- RHSA-2008:0008 vendor-advisory
- FEDORA-2008-1711 vendor-advisory
- RHSA-2008:0009 vendor-advisory
- MDVSA-2008:014 vendor-advisory
- 29420 third-party-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm
- 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list
- 28467 third-party-advisory
- 29348 third-party-advisory
- RHSA-2008:0004 vendor-advisory
- [security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list
- 28607 third-party-advisory
- SUSE-SA:2008:021 vendor-advisory
- MDVSA-2008:015 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307562
- 28471 third-party-advisory
- USN-575-1 vendor-advisory
- 29640 third-party-advisory
- 28977 third-party-advisory
- ADV-2008-1875 vdb-entry
- 30732 third-party-advisory
- 35650 third-party-advisory
- MDVSA-2008:016 vendor-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [5/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list