Red Hat Security Advisory: httpd:2.4 security, bug fix, and enhancement update

Important

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709.

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

A flaw was found in the mod_dav_lock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request.

CWE-476 - NULL Pointer Dereference

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system.

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie* directives. This could lead to a denial of service (DoS) condition, making the server unavailable to legitimate users.

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

A flaw was found in Apache HTTP Server, specifically within the mod_xml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service, information disclosure, or possibly arbitrary code execution.

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when `mod_headers` and `mod_mime` are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service.

CWE-125 - Out-of-bounds Read

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol (OCSP) requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or cause a denial of service.

CWE-125 - Out-of-bounds Read

A flaw was found in the `mod_proxy_ftp` module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol (FTP) server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service (DoS) for the affected server.

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')