p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in apache2 · Seite 4

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für apache2: 19. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 67

  1. CVE-2024-38474

    Hoch · CVSS 8.1EPSS 2,46%Korrektur verfügbar

    Apache HTTP Server weakness with encoded question marks in backreferences

    Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

    apache2Betriebssysteme
    • Auf 2.4.58-1ubuntu8.8 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2024-38473

    Hoch · CVSS 8.1EPSS 25,88%Öffentlicher ExploitKorrektur verfügbar

    Apache HTTP Server proxy encoding problem

    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

    apache2Betriebssysteme
    • Auf 2.4.58-1ubuntu8.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2024-27316

    Hoch · CVSS 7.5EPSS 91,33%Korrektur verfügbar

    Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

    apache2Betriebssysteme
    • Auf 2.4.58-1ubuntu8.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2024-24795

    Mittel · CVSS 6.3EPSS 2,87%Korrektur verfügbar

    Apache HTTP Server: HTTP Response Splitting in multiple modules

    HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

    apache2Betriebssysteme
    • Auf 2.4.58-1ubuntu8.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2023-45802

    Mittel · CVSS 5.9EPSS 3,17%Korrektur verfügbar

    Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST

    When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept me

    apache2Betriebssysteme
    • Auf 2.4.58-1ubuntu1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →