CVE-2022-37436
Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
Résumé
Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.
Paquets affectés
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.55"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2022-37436 apache2 Corrigé dans: 2.4.55-r0
- Debian DEBIAN-CVE-2022-37436 apache2 Corrigé dans: 2.4.56-1~deb11u1
- Ubuntu UBUNTU-CVE-2022-37436 apache2
Références
- advisory httpd.apache.org
- advisory security.gentoo.org
- advisory nvd.nist.gov
- advisory github.com