CVE-2024-24795
Apache HTTP Server: HTTP Response Splitting in multiple modules
Summary
Apache HTTP Server: HTTP Response Splitting in multiple modules
Original description
The description as published by the source.
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.
Users are recommended to upgrade to version 2.4.59, which fixes this issue.
Affected packages
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.59"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2024-24795 apache2 Fixed in: 2.4.59-r0
- Debian DEBIAN-CVE-2024-24795 apache2 Fixed in: 2.4.59-1~deb11u1
- Ubuntu UBUNTU-CVE-2024-24795 apache2 Fixed in: 2.4.7-1ubuntu4.22+esm12
References
- advisory httpd.apache.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web lists.fedoraproject.org
- web openwall.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.debian.org
- web lists.debian.org
- web support.apple.com
- web seclists.org