You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2025/07/11 01:18:33 UTC
(httpd-site) branch main updated: add finder
This is an automated email from the ASF dual-hosted git repository.
covener pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/httpd-site.git
The following commit(s) were added to refs/heads/main by this push:
new aaa1363 add finder
aaa1363 is described below
commit aaa13630a3d6843b4259775cdcc408e32465a438
Author: Eric Covener <ec...@us.ibm.com>
AuthorDate: Thu Jul 10 21:18:28 2025 -0400
add finder
---
content/security/json/CVE-2024-43204.json | 177 ++++++++++++++++--------------
1 file changed, 96 insertions(+), 81 deletions(-)
diff --git a/content/security/json/CVE-2024-43204.json b/content/security/json/CVE-2024-43204.json
index ef8e740..f07a0de 100644
--- a/content/security/json/CVE-2024-43204.json
+++ b/content/security/json/CVE-2024-43204.json
@@ -1,86 +1,101 @@
{
- "containers": {
- "cna": {
- "affected": [
- {
- "defaultStatus": "unaffected",
- "product": "Apache HTTP Server",
- "vendor": "Apache Software Foundation",
- "versions": [
- {
- "lessThanOrEqual": "2.4.63",
- "status": "affected",
- "version": "2.4.0",
- "versionType": "semver"
- }
- ]
- }
- ],
- "descriptions": [
- {
- "lang": "en",
- "supportingMedia": [
- {
- "base64": false,
- "type": "text/html",
- "value": "SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.<br><br>Users are recommended to upgrade to version 2.4.64 which fixes this issue. "
- }
- ],
- "value": "SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue. "
- }
- ],
- "metrics": [
- {
- "other": {
- "content": {
- "text": "low"
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.63",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "xiaojunjie@安恒信息杭州市滨江区技能大师工作室"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.<br><br>Users are recommended to upgrade to version 2.4.64 which fixes this issue."
+ }
+ ],
+ "value": "SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-918",
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
},
- "type": "Textual description of severity"
- }
- }
- ],
- "problemTypes": [
- {
- "descriptions": [
- {
- "cweId": "CWE-918",
- "description": "CWE-918 Server-Side Request Forgery (SSRF)",
- "lang": "en",
- "type": "CWE"
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-08-07T09:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2025-07-07T00:00:00.000Z",
+ "value": "2.4.x revision"
+ }
+ ],
+ "title": "Apache HTTP Server: SSRF with mod_headers setting Content-Type header",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
}
- ]
- }
- ],
- "providerMetadata": {
- "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
- },
- "source": {
- "discovery": "UNKNOWN"
- },
- "timeline": [
- {
- "lang": "en",
- "time": "2024-08-07T09:00:00.000Z",
- "value": "reported"
- },
- {
- "lang": "eng",
- "time": "2025-07-10",
- "value": "2.4.64 released"
}
- ],
- "title": "Apache HTTP Server: SSRF with mod_headers setting Content-Type header",
- "x_generator": {
- "engine": "Vulnogram 0.1.0-dev"
- }
- }
- },
- "cveMetadata": {
- "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
- "cveId": "CVE-2024-43204",
- "serial": 1,
- "state": "PUBLISHED"
- },
- "dataType": "CVE_RECORD",
- "dataVersion": "5.0"
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-43204",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
}