CLSA-2023-1675985294 Fix CVE(s): CVE-2022-37436

SECURITY UPDATE: modproxy may trigger HTTP response splitting - debian/patches/CVE-2022-37436.patch: fail on bad header - CVE-2022-37436...

Updated apache packages fix security vulnerability

CVE-2022-37436: Apache HTTP Server: modproxy prior to 2.4.55 allows a backend to trigger HTTP response splitting. Prior to 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers ha...

CVE-2019-25101

A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible to initiate the attack remotely...

CVE-2019-25101 OnShift TurboGears HTTP Header controllers.py response splitting

A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible to initiate the attack remotely...

CVE-2019-25101

OnShift TurboGears 1.0.11.10 is affected by a critical issue in the HTTP Header Handler (tur bogears/controllers.py) that enables HTTP response splitting. The vulnerability is exploitable remotely and is addressed by upgrading to version 1.0.11.11. The patch is identified as f68bbaba47f4474e1da55...

PT-2023-11359

Name of the Vulnerable Software and Affected Versions OnShift TurboGears version 1.0.11.10 Description A critical vulnerability has been found in OnShift TurboGears, affecting an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to htt...

CVE-2022-37436

...

The vulnerability of the mod_proxy module in the Apache HTTP Server allows attackers to perform attacks that involve splitting HTTP responses.

The vulnerability of the modproxy module in the Apache HTTP Server is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to perform attacks that involve splitting HTTP responses...

Symantec Identity Manager 跨站脚本漏洞

Symantec Identity Manager is an identity management system from Symantec Corporation. A security vulnerability exists in Symantec Identity Manager versions 14.3 CP3, 14.4.1, and 14.4.2, which stems from a user inputting a CRLF sequence that results in the returned response being split into two...

Amazon Linux 2022 : ruby3.1, ruby3.1-bundled-gems, ruby3.1-default-gems (ALAS2022-2023-262)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-262 advisory. The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP...

CVE-2023-23950

Technical details about CVE-2023-23950 are not present in the provided connected documents; the materials only restate the CRLF-splitting vulnerability without product/version specifics. Monitor for updates.

CVE-2023-23950

User’s supplied input usually a CRLF sequence can be used to split a returning response into two responses...

Ubuntu 18.04 LTS / 22.04 LTS : Ruby vulnerability (USN-5806-2)

The remote Ubuntu 18.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5806-2 advisory. USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.10. Tenable has extracte...

HTTP Response Splitting

apache2 is vulnerable to HTTP Response Splitting. A malicious backend may cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client...

Apache HTTP Server < 2.4.55 Multiple Vulnerabilities - Windows

Apache HTTP Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:httpserver"; if...

CVE-2022-37436 Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client...

CVE-2022-37436 Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client...

Ubuntu 16.04 ESM : Ruby vulnerability (USN-5806-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5806-1 advisory. Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could...

Apache httpd -- Multiple vulnerabilities

The Apache httpd project reports: moddav out of bounds read, or write of zero byte CVE-2006-20001 moderate modproxyajp Possible request smuggling CVE-2022-36760 moderate modproxy prior to 2.4.55 allows a backend to trigger HTTP response splitting CVE-2022-37436 moderate...

Debian DSA-5316-1 : netty - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5316 advisory. Several out-of-memory, stack overflow or HTTP request smuggling vulnerabilities have been discovered in Netty, a Java NIO client/server socket framework, which ma...