Skip to content
OpenAdvisories
Unscored CVE-2012-4557 EUVD-2012-4485GHSA-9p9q-h6h7-37g9

The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long …

Published Nov 30, 2012 · Updated Aug 6, 2024 · Assigned by redhat

Package: apache2 Ecosystem: Debian

Description

The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache2 2.2.22-1 —
Debian 13 apache2 2.2.22-1 —
Debian 12 apache2 2.2.22-1 —
Debian 6.0 apache2 2.2.16-6+squeeze10 DSA-2579-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 httpd +3 2.2.15-26.el6 RHSA-2013:0512
RHEL 6 mod_ssl 1:2.2.15-26.el6 RHSA-2013:0512
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat JBoss Web Server 1 ant 1.7.1-13.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 ant-commons-net 1.7.1-14.ep5.el6 RHSA-2011:0897
Red Hat JBoss Web Server 1 ant-jmf +16 1.7.1-13.jdk6.ep5.el5 RHSA-2011:0897
Red Hat JBoss Web Server 1 antlr 2.7.7-7.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 bcel 5.2-8.1.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 cglib 2.2-5.1.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 dom4j 1.6.1-11.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 ecj 1:3.3.1.1-3.2.2.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 ecj3 1:3.3.1.1-3.1.1.1.jdk6.ep5.el5 RHSA-2011:0897
Red Hat JBoss Web Server 1 glassfish-jaf 1.1.0-6.1.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 glassfish-javamail 1.4.2-0.4.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 glassfish-jsf 1.2_13-2.2.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 hibernate3 +1 1:3.3.2-1.4.GA_CP04.ep5.el5 RHSA-2011:0897
Red Hat JBoss Web Server 1 hibernate3-annotations +1 3.4.0-3.2.GA_CP04.ep5.el5 RHSA-2011:0897
Red Hat JBoss Web Server 1 hibernate3-commons-annotations +1 3.1.0-1.8.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 hibernate3-ejb-persistence-3.0-api +1 1:1.0.2-3.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 hibernate3-entitymanager +1 3.4.0-4.3.GA_CP04.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 httpd +2 2.2.17-11.1.ep5.el5 RHSA-2011:0897
Red Hat JBoss Web Server 1 httpd-tools 2.2.17-11.2.ep5.el6 RHSA-2011:0897
Red Hat JBoss Web Server 1 httpd22 +6 2.2.17-14.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-beanutils 1.8.0-4.1.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-chain 1.2-2.2.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-codec 1.3-9.1.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-collections +1 3.2.1-4.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-daemon 1:1.0.5-1.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-daemon-jsvc 1:1.0.5-1.4.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-dbcp +1 1.2.1-16.2.ep5.el6 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-digester 1.8.1-8.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-el 1.0-19.2.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-fileupload 1:1.1.1-7.4.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-httpclient 1:3.1-1.1.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-io 1.4-1.3.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-launcher 1.1-4.6.1.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-logging +1 1.1.1-0.4.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-logging-jboss 1.1-10.2.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-modeler 2.0-4.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-pool +1 1.3-11.2.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-commons-validator 1.3.1-7.5.1.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-oro 2.0.8-3.3.2.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jakarta-taglibs-standard 1.1.1-9.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 javassist 3.12.0-1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jboss-common-core 2.2.17-1.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jboss-common-logging-jdk +1 2.1.2-1.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jboss-javaee +3 5.0.1-2.9.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jcommon 1.0.16-1.2.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 jfreechart 1.0.13-2.3.2.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 log4j 1.2.14-18.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 mod_cluster +5 1.0.10-2.GA_CP01.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 mod_jk +2 1.2.31-1.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 mod_ssl 1:2.2.17-11.1.ep5.el5 RHSA-2011:0897
Red Hat JBoss Web Server 1 mod_ssl22 1:2.2.17-14.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 mx4j 1:3.0.1-9.3.4.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 objectweb-asm 3.1-5.3.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 objectweb-asm31 3.1-12.1.ep5.el6 RHSA-2011:0897
Red Hat JBoss Web Server 1 regexp 1.5-1.2.1.jdk6.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 struts12 1.2.9-3.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 tomcat-jkstatus-ant 1.2.31-2.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 tomcat-native 1.1.20-2.0.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 tomcat5 +12 5.5.33-14_patch_04.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 tomcat6 +9 6.0.32-14_patch_03.ep5.el6 RHSA-2011:0897
Red Hat JBoss Web Server 1 xalan-j2 2.7.1-5.3_patch_04.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 xerces-j2 2.9.1-3.patch01.1.ep5.el4 RHSA-2011:0897
Red Hat JBoss Web Server 1 xml-commons +3 1.3.04-7.10.jdk6.ep5.el5 RHSA-2011:0897
Red Hat JBoss Web Server 1 xml-commons-which10 +4 1.3.04-7.14.ep5.el6 RHSA-2011:0897

Advisories 3

References