Описание
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A flaw was found in httpd's mod_auth_digest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server's authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce checking (AuthDigestNcCheck) or zero-duration nonce lifetimes (AuthDigestNonceLifetime), are enabled.
Меры по смягчению последствий
To mitigate this issue, apply one of the following configuration options:
- Disable
mod_auth_digestif Digest authentication is not required: In/etc/httpd/conf.modules.d/00-base.conf(or the relevant module configuration file), comment out the loading of the module:
- If Digest authentication is required, ensure vulnerable settings are disabled:
Ensure
AuthDigestNcCheckis set toOff(or removed, asOffis the default) and ensureAuthDigestNonceLifetimeis not set to0(the default value is 300 seconds). After applying configuration adjustments, reload the web server:
Warning: Reloading or restarting the httpd service may briefly disrupt active client connections. Disabling mod_auth_digest will cause authentication failures for resources configured with AuthType Digest.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | httpd | Affected | ||
| Red Hat Enterprise Linux 6 | httpd | Not affected | ||
| Red Hat Enterprise Linux 7 | httpd | Affected | ||
| Red Hat Enterprise Linux 8 | httpd:2.4/httpd | Affected | ||
| Red Hat JBoss Core Services | jbcs-httpd24-httpd | Fix deferred | ||
| Red Hat Enterprise Linux 9 | httpd | Fixed | RHSA-2026:88229 | 22.10.2026 |
| Red Hat Hardened Images | httpd-main-2.4.69-1.hum1 | Fixed | RHSA-2026:74858 | 02.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.6 Medium
CVSS3
Связанные уязвимости
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Use after free in mod_auth_digest in Apache Software Foundation Apache ...
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
EPSS
5.6 Medium
CVSS3