This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache HTTP server 2.4.59 fixes 3 vulnerabilities
On 04.04.2024, Apache HTTP server version 2.4.59 was released, which fixes two moderate-severity and one low-severity vulnerability [1].
An unauthenticated remote attacker can use a continuous stream of HTTP/2 headers to cause unbounded buffer growth, leading to resource exhaustion and denial of service [2].
The vulnerability is present in products:
- apache httpd;>=2.4.17,<=2.4.58
- apache http_server;>=2.4.17,<=2.4.58
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-27316 at cve.org, NVD
- CWE-400 at cwe.mitre.org
The vulnerability was publicly disclosed 4. 4. 2024.
An authenticated remote attacker can cause HTTP desynchronization by injecting response headers into backend applications [3].
The vulnerability is present in products:
- apache httpd;>=2.4.0,<=2.4.58
- apache http_server;>=2.4.0,<=2.4.58
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
More information:
- CVE-2024-24795 at cve.org, NVD
- CWE-74 at cwe.mitre.org
The vulnerability was publicly disclosed 4. 4. 2024.
A compromised or malicious backend application can, due to insufficient input validation, cause HTTP response splitting [4].
The vulnerability is present in products:
- apache httpd;<=2.4.58
- apache http_server;<=2.4.58
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2023-38709 at cve.org, NVD
- CWE-20 at cwe.mitre.org
The vulnerability was publicly disclosed 4. 4. 2024.
Links
CESNET, z.s.p.o. on 5. 4. 2024.