Schwachstellen im Stack Webserver · Seite 10

Apache HTTP Server: HTTP response splitting

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

• Auf 2.4.18-2ubuntu3.17+esm12 aktualisieren
• Auf 2.4.29-1ubuntu4.27+esm2 aktualisieren
• Auf 2.4.41-4ubuntu3.17 aktualisieren
• Auf 2.4.52-1ubuntu4.9 aktualisieren
• Auf 2.4.58-1ubuntu8.1 aktualisieren
• Auf 2.4.59-1 aktualisieren
• Auf 2.4.59-1~deb12u1 aktualisieren
• Auf 2.4.7-1ubuntu4.22+esm12 aktualisieren

NGINX HTTP/3 QUIC vulnerability

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

• Auf 1.25.4 aktualisieren
• Auf 1.26.0-1 aktualisieren

NGINX HTTP/3 QUIC vulnerability

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated

• Auf 1.25.4 aktualisieren
• Auf 1.26.0-1 aktualisieren

Uncontrolled Resource Consumption in Traefik

Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Denial of service whith ACME HTTPChallenge in Traefik

Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`.

Apache HTTP Server: mod_macro buffer over-read

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.

• Auf 2.4.18-2ubuntu3.17+esm11 aktualisieren
• Auf 2.4.29-1ubuntu4.27+esm1 aktualisieren
• Auf 2.4.41-4ubuntu3.15 aktualisieren
• Auf 2.4.52-1ubuntu4.7 aktualisieren
• Auf 2.4.58-1 aktualisieren
• Auf 2.4.59-1~deb12u1 aktualisieren
• Auf 2.4.7-1ubuntu4.22+esm9 aktualisieren

Apache HTTP Server: DoS in HTTP/2 with initial windows size 0

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

• Auf 2.4.58-1 aktualisieren
• Auf 2.4.59-1~deb12u1 aktualisieren

Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept me

• Auf 2.4.29-1ubuntu4.27+esm7 aktualisieren
• Auf 2.4.41-4ubuntu3.15 aktualisieren
• Auf 2.4.52-1ubuntu4.7 aktualisieren
• Auf 2.4.58-1 aktualisieren
• Auf 2.4.58-1ubuntu1 aktualisieren
• Auf 2.4.59-1~deb12u1 aktualisieren

HTTP header parsing could cause a deny of service

Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.

CVE-2023-25950

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

• Auf 2.6.8-1 aktualisieren

Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

• Auf 2.0.22 aktualisieren
• Auf 2.4.41-4ubuntu3.14 aktualisieren
• Auf 2.4.52-1ubuntu4.4 aktualisieren
• Auf 2.4.56-1 aktualisieren

Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of acc

• Auf 2.4.18-2ubuntu3.17+esm10 aktualisieren
• Auf 2.4.29-1ubuntu4.27 aktualisieren
• Auf 2.4.41-4ubuntu3.14 aktualisieren
• Auf 2.4.52-1ubuntu4.4 aktualisieren
• Auf 2.4.56-1 aktualisieren

Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

• Auf 2.4.18-2ubuntu3.17+esm9 aktualisieren
• Auf 2.4.29-1ubuntu4.26 aktualisieren
• Auf 2.4.41-4ubuntu3.13 aktualisieren
• Auf 2.4.52-1ubuntu4.3 aktualisieren
• Auf 2.4.55 aktualisieren
• Auf 2.4.55-1 aktualisieren

Apache HTTP Server: mod_proxy_ajp Possible request smuggling

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.

• Auf 2.4.18-2ubuntu3.17+esm8 aktualisieren
• Auf 2.4.29-1ubuntu4.26 aktualisieren
• Auf 2.4.41-4ubuntu3.13 aktualisieren
• Auf 2.4.52-1ubuntu4.3 aktualisieren
• Auf 2.4.55-1 aktualisieren

Apache HTTP Server: mod_dav out of bounds read, or write of zero byte

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.

• Auf 2.4.18-2ubuntu3.17+esm8 aktualisieren
• Auf 2.4.29-1ubuntu4.26 aktualisieren
• Auf 2.4.41-4ubuntu3.13 aktualisieren
• Auf 2.4.52-1ubuntu4.3 aktualisieren
• Auf 2.4.55-1 aktualisieren

Routes exposed with an empty TLSOption in traefik

Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your TLS options.

Authorization header displayed in the debug logs

Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed in the debug logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to upgrade may set the log level to `INFO`, `WARN`, or `ERROR`.

NGINX ngx_http_mp4_module vulnerability CVE-2022-41742

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video

• Auf 1.10.3-0ubuntu0.16.04.5+esm5 aktualisieren
• Auf 1.14.0-0ubuntu1.11 aktualisieren
• Auf 1.18.0-0ubuntu1.4 aktualisieren
• Auf 1.18.0-6ubuntu14.3 aktualisieren
• Auf 1.22.1-1 aktualisieren
• Auf 1.23.2 aktualisieren
• Auf 1.4.6-1ubuntu3.9+esm4 aktualisieren

NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file wi

• Auf 1.10.3-0ubuntu0.16.04.5+esm5 aktualisieren
• Auf 1.14.0-0ubuntu1.11 aktualisieren
• Auf 1.18.0-0ubuntu1.4 aktualisieren
• Auf 1.18.0-6ubuntu14.3 aktualisieren
• Auf 1.22.1-1 aktualisieren
• Auf 1.23.2 aktualisieren
• Auf 1.4.6-1ubuntu3.9+esm4 aktualisieren