Astra Linux – vulnerability in curl

curl versions prior to 7.84.0 support “chained” HTTP compression algorithms; this means a server response can be compressed multiple times using different algorithms. The number of allowable “links” within this “decompression chain” is virtually unlimited, enabling a malicious server to insert an...

Astra Linux – Vulnerability in Apache2

The “Use After Free” vulnerability in the Apache HTTP Server module modhttp2 occurs when file handles are already exhausted. This issue affects Apache HTTP Server versions 2.4.55 through 2.4.67...

Astra Linux – vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with modxml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

Astra Linux – Vulnerability in http-parser

HTTP request smuggling in Node.js versions 10, 12, and 13 causes the delivery of malicious payloads when transfer-encoding is malformed...

Astra Linux – vulnerability in python2.7, pypy

In Python 3.x versions prior to 3.5.10, 3.6.x prior to 3.6.12, 3.7.x prior to 3.7.9, and 3.8.x prior to 3.8.5, CRLF injection is possible if the attacker controls the HTTP request method; this was demonstrated by inserting CR and LF control characters into the first argument of...

Astra Linux – Vulnerability in curl

During an upload process, curl improperly handles HTTP/2 RSTSTREAM requests received from the server. This occurs when the reason for the refusal is HTTP11REQUIRED or REFUSEDSTREAM. As a result, a use-after-free condition arises for the struct Curleasy object...

Astra Linux – vulnerability in python3.11

When reading an HTTP response from a server, if no read amount is specified, the default behavior is to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially leading to an Out-of-Memory OOM condition or other types of...

Astra Linux – vulnerability in curl

A poorly protected credential vulnerability in curl 7.83.0 may lead to the leakage of authentication or cookie header data via HTTP redirects to the same host but a different port number...

Astra Linux – vulnerability in Apache2

The Loop with Unreachable Exit Condition ‘Infinite Loop’ vulnerability exists in the modproxyftp module of the Apache HTTP Server when an attacker controls a backend FTP server. This issue affects versions 2.4.0 through 2.4.67. Users are advised to upgrade to version 2.4.68, which resolves the...

Astra Linux – Vulnerability in symfony

Symfony/http-foundation is a module for the Symphony PHP framework that defines an object-oriented layer for handling HTTP requests. The Request class does not parse URIs containing special characters in the same way that browsers do. As a result, attackers can trick validators that rely on the...

Astra Linux – Vulnerability in Apache2

Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...

Astra Linux – vulnerability in Apache2

Buffer over-read vulnerability in Apache HTTP Server caused by outbound OCSP requests to an attacker-controlled OCSP server This issue affects Apache HTTP Server versions 2.4.0 through 2.4.67. Users are advised to upgrade to version 2.4.68, which resolves the issue...

Astra Linux – vulnerability in Apache2

HTTP response splitting in the core of Apache HTTP Server enables an attacker capable of manipulating the Content-Type response headers of applications hosted or proxied by the server to split the HTTP response. This vulnerability was identified as CVE-2023-38709; however, the patch included in...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup’s SoupServer HTTP Range header processing. The sortranges comparator in soup-message-headers.c truncates a 64-bit subtraction result to a 32-bit integer, flipping the sign for range offsets that differ by more than INTMAX. This results in the silently omission of...

Astra Linux – vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie This issue affects Apache HTTP Server: versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

Astra Linux – Vulnerability in Apache2

A out-of-bounds read vulnerability exists in the modmacro module of the Apache HTTP Server. This issue affects the Apache HTTP Server version up to 2.4.57...

Astra Linux – Vulnerability in PHP 8.1

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, and 8.3. before 8.3.14, when using streams with a configured proxy and the “requestfulluri” option, the URI is not properly sanitized. This can lead to HTTP request smuggling, allowing attackers to use the proxy to send arbitrary HTTP reques...

Astra Linux – Vulnerability in Golang-1.19

A malicious HTTP/2 client that quickly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is limited by the http2.Server.MaxConcurrentStreams setting, resetting an ongoing request allows the attacker to create a new...

Astra Linux – vulnerability in Thunderbird

When an HTTPS page was embedded within an HTTP page, and a service worker was registered for the former, the service worker could have intercepted the request for the secure page despite the fact that the iframe did not constitute a secure context due to the insecure framing. This vulnerability...

Astra Linux - vulnerability in Puma

Puma is an HTTP 1.1 server designed for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy that forwards HTTP header values containing the LF character could lead to HTTP request smuggling. A client could thus smuggle a request through the proxy, causing the proxy ...