CVE-2023-31122 — Apache HTTP Server: mod_macro buffer over-read

Description

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache HTTP Server	≤ 2.4.57	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache2	2.4.58-1	—
Debian 13	apache2	2.4.58-1	—
Debian 12	apache2	2.4.59-1~deb12u1	DSA-5662-1
Debian 11	apache2	2.4.59-1~deb11u1	DSA-5662-1
Debian 10	apache2	2.4.59-1~deb10u1	DLA-3818-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	apache2	2.4.52-1ubuntu4.7	USN-6506-1
Ubuntu 20.04 LTS	apache2	2.4.41-4ubuntu3.15	USN-6506-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	apache2	2.4.29-1ubuntu4.27+esm1	USN-6510-1
Ubuntu Pro 16.04 LTS	apache2	2.4.18-2ubuntu3.17+esm11	USN-6510-1
Ubuntu Pro 14.04 LTS	apache2	2.4.7-1ubuntu4.22+esm9	USN-6510-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	httpd +8	2.4.57-8.el9	RHSA-2024:2278
RHEL 9	mod_ssl +1	1:2.4.57-8.el9	RHSA-2024:2278
RHEL 8	httpd +6	2.4.37-64.module+el8.10.0+21332+dfb1b40e	RHSA-2024:3121
RHEL 8	mod_http2	1.15.7-10.module+el8.10.0+21653+eaff63f0	RHSA-2024:3121
RHEL 8	mod_md	1:2.0.8-8.module+el8.9.0+19080+567b90f8	RHSA-2024:3121
RHEL 8	mod_ssl +1	1:2.4.37-64.module+el8.10.0+21332+dfb1b40e	RHSA-2024:3121

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Core Services 1	jbcs-httpd24-curl +2	8.6.0-3.el7jbcs	RHSA-2024:1316
Red Hat JBoss Core Services 1	jbcs-httpd24-httpd +6	2.4.57-9.el7jbcs	RHSA-2024:1316
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_proxy_cluster	1.3.20-3.el7jbcs	RHSA-2024:1316
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_ssl +1	1:2.4.57-9.el7jbcs	RHSA-2024:1316
Red Hat JBoss Core Services 1	jbcs-httpd24-openssl +4	1:1.1.1k-17.el7jbcs	RHSA-2024:1316

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	httpd +8	2.4.57-8.el9	ALSA-2024:2278
AlmaLinux 9	mod_ssl +1	1:2.4.57-8.el9	ALSA-2024:2278
AlmaLinux 8	httpd +6	2.4.37-64.module_el8.10.0+3761+75f8c656	ALSA-2024:3121
AlmaLinux 8	mod_http2	1.15.7-10.module_el8.10.0+3832+564e7653	ALSA-2024:3121
AlmaLinux 8	mod_md	1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa	ALSA-2024:3121
AlmaLinux 8	mod_ssl +1	1:2.4.37-64.module_el8.10.0+3761+75f8c656	ALSA-2024:3121

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 8	httpd	2.4.37-64.module+el8.10.0+1717+030a9fed	RLSA-2024:3121
Rocky Linux 8	mod_http2	1.15.7-10.module+el8.10.0+1775+6b057638	RLSA-2024:3121
Rocky Linux 8	mod_md	1:2.0.8-8.module+el8.9.0+1370+89cc8ad5	RLSA-2024:3121

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP5	apache2	2.4.51-150400.6.14.1	SUSE-SU-2026:2686-1, SUSE-SU-2023:4430-1
SLES 15 SP4	apache2	2.4.51-150400.6.14.1	SUSE-SU-2026:2686-1, SUSE-SU-2023:4430-1
SLES 15 SP3	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1
SLES 15 SP2	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1
SLES 15 SP1	apache2	2.4.33-150000.3.78.1	SUSE-SU-2023:4432-1

Show 15 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	apache2 +1	2.4.51-35.35.1	SUSE-SU-2023:4451-1
SLES for SAP 15 SP5	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLES for SAP 15 SP4	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLES for SAP 15 SP3	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1
SLES for SAP 15 SP2	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1
SLES for SAP 15 SP1	apache2	2.4.33-150000.3.78.1	SUSE-SU-2023:4432-1
SLES for SAP 12 SP5	apache2 +1	2.4.51-35.35.1	SUSE-SU-2023:4451-1
SLE HPC 15 SP5	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLE HPC 15 SP4	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLE HPC 15 SP3	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1
SLE HPC 15 SP2	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1
SLE HPC 15 SP1	apache2	2.4.33-150000.3.78.1	SUSE-SU-2023:4432-1
SUSE Manager Server 4.2	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1
SUSE Manager Proxy 4.2	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1
SUSE Enterprise Storage 7.1	apache2	2.4.51-150200.3.59.1	SUSE-SU-2023:4431-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	apache2	2.4.58-1.1	openSUSE-SU-2024:13350-1
openSUSE Leap 15.5	apache2	2.4.51-150400.6.14.1	SUSE-SU-2023:4430-1
openSUSE Leap 15.4	apache2	2.4.51-150400.6.14.1	SUSE-SU-2023:4430-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	apache2	2.4.58-r0	—
Alpine v3.23	apache2	2.4.58-r0	—
Alpine v3.22	apache2	2.4.58-r0	—
Alpine v3.21	apache2	2.4.58-r0	—
Alpine v3.20	apache2	2.4.58-r0	—

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	apache2	2.4.58-r0	—
Alpine v3.18	apache2	2.4.58-r0	—
Alpine v3.17	apache2	2.4.58-r0	—
Alpine v3.16	apache2	2.4.58-r0	—
Alpine v3.15	apache2	2.4.58-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	httpd +8	2.4.58-1.amzn2023	ALAS2023-2023-433
Amazon Linux 2023	mod_ssl +1	1:2.4.58-1.amzn2023	ALAS2023-2023-433
Amazon Linux 2	httpd +7	2.4.58-1.amzn2	ALAS2-2023-2322
Amazon Linux 2	mod_ssl +1	1:2.4.58-1.amzn2	ALAS2-2023-2322

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	httpd +8	2.4.57-8.0.1.el9	ELSA-2024-2278
Oracle Linux 9	mod_ssl +1	1:2.4.57-8.0.1.el9	ELSA-2024-2278
Oracle Linux 8	httpd +6	2.4.37-64.module+el8.10.0+90271+3bc76a16	ELSA-2024-3121
Oracle Linux 8	mod_http2	1.15.7-10.module+el8.10.0+90327+96b8ea28	ELSA-2024-3121
Oracle Linux 8	mod_md	1:2.0.8-8.module+el8.9.0+90011+2f9c6a23	ELSA-2024-3121
Oracle Linux 8	mod_ssl +1	1:2.4.37-64.module+el8.10.0+90271+3bc76a16	ELSA-2024-3121

Advisories 31

ALSA-2024:2278 Moderate: httpd security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:3121 Moderate: httpd:2.4 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:1316 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2024:3121 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2024:2278 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
WID-SEC-2023-2712 Apache HTTP Server: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 10, 2026
SUSE-SU-2026:2686-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 1, 2026
WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
USN-6510-1 apache2 vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
WID-SEC-2024-1226 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
USN-6506-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-5662-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3818-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2024:3121 Moderate: httpd:2.4 security update Rocky Linux Security Advisories · Feb 5, 2026
openSUSE-SU-2024:13350-1 apache2-2.4.58-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:4451-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:4431-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:4432-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
WID-SEC-2024-0899 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2025
SUSE-SU-2023:4430-1 Security update for apache2 SUSE / openSUSE Security Updates · May 2, 2025
ICSA-25-133-01 Hitachi Energy Service Suite CISA ICS & IT advisories · Feb 25, 2025
WID-SEC-2024-0769 IBM Rational Build Forge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 7, 2024
NCSC-2024-0332 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Aug 13, 2024
ICSA-24-228-06 Siemens SINEC NMS CISA ICS & IT advisories · Aug 13, 2024
SSA-784301 SSA-784301: Multiple Vulnerabilities in SINEC NMS Before V3.0 Siemens ProductCERT · Aug 13, 2024
ELSA-2024-3121 Moderate: httpd:2.4 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2024
ELSA-2024-2278 Moderate: httpd security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 3, 2024
WID-SEC-2024-0107 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
ALAS2023-2023-433 Important: httpd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 14, 2023
ALAS2-2023-2322 Important: httpd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 1, 2023

Apache HTTP Server: mod_macro buffer over-read

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Oracle Linux

Advisories 31

References