You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2024/07/03 12:27:09 UTC
(httpd-site) branch main updated: Revert "elaborate on affected configurations"
This is an automated email from the ASF dual-hosted git repository.
covener pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/httpd-site.git
The following commit(s) were added to refs/heads/main by this push:
new 1ecfff9 Revert "elaborate on affected configurations"
1ecfff9 is described below
commit 1ecfff9ef2bd02eb6fd6500f54fd8a55553910b0
Author: Eric Covener <ec...@us.ibm.com>
AuthorDate: Wed Jul 3 08:26:58 2024 -0400
Revert "elaborate on affected configurations"
This reverts commit 8665d880dcac09fe642eea8f944f0638b797d557.
---
content/security/json/CVE-2024-38473.json | 184 +++++++++++++++---------------
1 file changed, 93 insertions(+), 91 deletions(-)
diff --git a/content/security/json/CVE-2024-38473.json b/content/security/json/CVE-2024-38473.json
index 5b99730..3a07f16 100644
--- a/content/security/json/CVE-2024-38473.json
+++ b/content/security/json/CVE-2024-38473.json
@@ -1,96 +1,98 @@
{
- "containers": {
- "cna": {
- "affected": [
- {
- "defaultStatus": "unaffected",
- "product": "Apache HTTP Server",
- "vendor": "Apache Software Foundation",
- "versions": [
- {
- "lessThanOrEqual": "2.4.59",
- "status": "affected",
- "version": "2.4.0",
- "versionType": "semver"
- }
- ]
- }
- ],
- "credits": [
- {
- "lang": "en",
- "type": "finder",
- "value": "Orange Tsai (@orange_8361) from DEVCORE"
- }
- ],
- "descriptions": [
- {
- "lang": "en",
- "supportingMedia": [
- {
- "base64": false,
- "type": "text/html",
- "value": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. This affects configurations where mechanisms other than ProxyPass/ProxyPassMatch or RewriteRule with the 'P' flag are used to configure a request to be proxied, such as SetHandler or inadvertent proxying via CVE-2024-39573. Note that the [...]
- }
- ],
- "value": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. This affects configurations where mechanisms other than ProxyPass/ProxyPassMatch or RewriteRule with the 'P' flag are used to configure a request to be proxied, such as SetHandler or inadvertent proxying via CVE-2024-39573. Note that these alternate mecha [...]
- }
- ],
- "metrics": [
- {
- "other": {
- "content": {
- "text": "moderate"
- },
- "type": "Textual description of severity"
- }
- }
- ],
- "problemTypes": [
- {
- "descriptions": [
- {
- "cweId": "CWE-116",
- "description": "CWE-116 Improper Encoding or Escaping of Output",
- "lang": "en",
- "type": "CWE"
- }
- ]
- }
- ],
- "providerMetadata": {
- "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
- },
- "references": [
- {
- "tags": [
- "vendor-advisory"
- ],
- "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
- }
- ],
- "source": {
- "discovery": "UNKNOWN"
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.<br>Users are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "value": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
},
- "timeline": [
- {
- "lang": "en",
- "time": "2024-04-01T12:00:00.000Z",
- "value": "reported"
- }
- ],
- "title": "Apache HTTP Server proxy encoding problem",
- "x_generator": {
- "engine": "Vulnogram 0.1.0-dev"
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-116",
+ "description": "CWE-116 Improper Encoding or Escaping of Output",
+ "lang": "en",
+ "type": "CWE"
}
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "time": "2024-07-01",
+ "lang": "en",
+ "value": "fixed by r1918559, r1918666, r1918600, r1918625, r1918668 in 2.4.x"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
}
- },
- "cveMetadata": {
- "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
- "cveId": "CVE-2024-38473",
- "serial": 1,
- "state": "PUBLISHED"
- },
- "dataType": "CVE_RECORD",
- "dataVersion": "5.0"
+ ],
+ "title": "Apache HTTP Server proxy encoding problem",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-38473",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
}