Описание
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| apache2 | fixed | 2.4.54-1 | package | |
| apache2 | fixed | 2.4.54-1~deb11u1 | bullseye | package |
| apache2 | fixed | 2.4.38-3+deb10u8 | buster | package |
Примечания
https://www.openwall.com/lists/oss-security/2022/06/08/8
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-31813
https://github.com/apache/httpd/commit/956f708b094698ac9ad570d640d4f30eb0df7305
https://www.synacktiv.com/publications/cve-2022-31813-forwarding-addresses-is-hard.html
EPSS
Связанные уязвимости
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
EPSS