git: 5b8077cf7686 - main - security/vuxml: Document Apache httpd vulnerabilities
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 11 Mar 2023 09:13:01 UTC
The branch main has been updated by joneum:
URL: https://cgit.FreeBSD.org/ports/commit/?id=5b8077cf76862715de1c5015386ff297f1415f8e
commit 5b8077cf76862715de1c5015386ff297f1415f8e
Author: Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2023-03-11 09:11:57 +0000
Commit: Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2023-03-11 09:12:55 +0000
security/vuxml: Document Apache httpd vulnerabilities
Sponsored by: Netzkommune GmbH
---
security/vuxml/vuln/2023.xml | 45 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index f472d06003cb..632fba0a9f9c 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,48 @@
+ <vuln vid="8edeb3c1-bfe7-11ed-96f5-3497f65b111b">
+ <topic>Apache httpd -- Multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>apache24</name>
+ <range><lt>2.4.56</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Apache httpd project reports:</p>
+ <blockquote cite="https://downloads.apache.org/httpd/CHANGES_2.4.56">
+ <ul>
+ <li>CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi
+ HTTP response splitting (cve.mitre.org).
+ HTTP Response Smuggling vulnerability in Apache HTTP Server
+ via mod_proxy_uwsgi. This issue affects Apache HTTP Server:
+ from 2.4.30 through 2.4.55.
+ Special characters in the origin response header can
+ truncate/split the response forwarded to the client.</li>
+ <li>CVE-2023-25690: HTTP request splitting with mod_rewrite
+ and mod_proxy (cve.mitre.org).
+ Some mod_proxy configurations on Apache HTTP Server versions
+ 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
+ Configurations are affected when mod_proxy is enabled along
+ with some form of RewriteRule or ProxyPassMatch in which a
+ non-specific pattern matches some portion of the user-supplied
+ request-target (URL) data and is then re-inserted into the
+ proxied request-target using variable substitution.
+ </li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2023-25690</cvename>
+ <cvename>CVE-2023-27522</cvename>
+ <url>https://downloads.apache.org/httpd/CHANGES_2.4.56</url>
+ </references>
+ <dates>
+ <discovery>2023-03-08</discovery>
+ <entry>2023-03-11</entry>
+ </dates>
+ </vuln>
+
<vuln vid="d357f6bb-0af4-4ac9-b096-eeec183ad829">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>