httpd: Padding Oracle in Apache mod_session_crypto

It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...

httpd: mod_http2 denial-of-service by thread starvation

A denial of service flaw was found in httpd's modhttp2 module. A remote attacker could use this flaw to block server threads for long times, causing starvation of worker threads, by manipulating the flow control windows on streams...

httpd: Apache HTTP Request Parsing Whitespace Defects

It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a...

PT-2017-2867 · Apache +5 · Apache Http Server +5

Name of the Vulnerable Software and Affected Versions: Apache httpd versions 2.2.x through 2.2.32 Apache httpd versions 2.4.x through 2.4.25 Description: The issue is caused by a buffer overflow in the mod mime module when handling a malicious Content-Type response header. This can allow a remote...

HPESBUX03725 rev.1 - HPE HP-UX Web Server Suite running Apache, Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Unauthorized Read Access to Data SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX Apache-based Web Server B.11.31 - httpd prior to B.2.4.18.02 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

UBUNTU-CVE-2017-6062

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" aka modauthopenidc module before 2.1.5 for the Apache HTTP Server does not skip OIDCCLAIM and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HT...

BSA-2017-115

Security Advisory ID : BSA-2017-115 Component : Apache HTTPD Revision : 2.0: Final The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow...

BSA-2017-501

Security Advisory ID : BSA-2017-501 Component : Apache HTTPD Revision : 2.0: Final In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to modauthdigest can cause the server to crash, and each instance continues to crash even for subsequently valid requests...

Unspecified Vulnerability in Apache HTTP Server

Apache httpd is the U.S. Apache Apache Software Foundation, an open source HTTP server developed and maintained specifically for modern operating systems. A security vulnerability exists in Apache httpd, which stems from the program's failure to properly parse HTTP headers. A remote attacker coul...

UBUNTU-CVE-2016-8743

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-en...

PT-2016-3150 · Apache +5 · Apache Http Server +5

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.2.32 and 2.4.25 Description: The issue is related to the improper handling of data by the Apache HTTP Server, which was liberal in accepting whitespace from requests and sending it in response lines and...

PT-2016-3323 · Apache +2 · Apache Http Server +2

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.4.24 Description: The issue is related to the implementation of mod remoteip and mod rewrite modules in the Apache HTTP Server, which is associated with insufficient authentication data verification. Thi...

mod_cluster: remotely Segfault Apache http server

It was discovered that it is possible to remotely Segfault Apache http server with a specially crafted string sent to the modcluster via service messages MCMP...

Apple OS X and OS X Server Apache HTTP Server Redirect Vulnerability

Apple OS X and OS X Server are both products of Apple Inc. Apple OS X is a specialized operating system developed for Mac computers; OS X Server is a set of Unix-based server operating software. Apache HTTP Server is the Apache Software Foundation's open source web server for Apple OS X. A...

HTTPD: sets environmental variable based on user supplied Proxy request header

It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could...

DEBIAN-CVE-2016-5387

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary...

USN-3038-1 apache2 vulnerability

It was discovered that the Apache HTTP Server would set the HTTPPROXY environment variable based on the contents of the Proxy header from HTTP requests. A remote attacker could possibly use this issue in combination with CGI scripts that honour the HTTPPROXY variable to redirect outgoing HTTP...

The vulnerability of the Apache HTTP Server software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in the modproxy module of the Apache HTTP Server when reverse proxy is enabled allows malicious actors to cause a service failure by using a specially crafted HTTP Connection header...

The vulnerability of the Apache HTTP Server software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in the deflateinfilter function of the moddeflate.c module in the Apache HTTP Server allows malicious actors to trigger a denial-of-service attack by sending a specially crafted request that is decompressed into a large amount of data...

[SECURITY] Fedora 23 Update: mod_nss-1.0.12-3.fc23

The modnss module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL and Transport Layer Security TLS protocols using the Network Security Services NSS security library...