Apache has released a security update to fix multiple vulnerabilities in Apache HTTP Server.
Apache HTTP Server version 2.4.54 and earlier is vulnerable to several attacks such as HTTP request smuggling, HTTP response splitting, and denial of service attacks.
The severity of the mentioned vulnerabilities could allow the attacker to gain access to the affected systems and cause a denial of service.
Sample of the addressed vulnerabilities:
1. Apache HTTP Server mod_proxy_ajp HTTP Request Smuggling (CVE-2022- 36760):
• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access
2. Apache HTTP Server mod_proxy Response Splitting (CVE-2022-37436):
• CVSS: 6.1
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Consequences: Gain Access
The enterprise should deploy patches as soon as the testing phase is completed.
Cookie | Duration | Description |
---|---|---|
cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |