SUSE-SU-2024:1788-1

Опубликовано: 27 мая 2024

Источник: suse-cvrf

Описание

Security update for apache2

This update for apache2 fixes the following issues:

CVE-2023-38709: Fixed faulty input validation inside the HTTP response splitting code (bsc#1222330).
CVE-2024-24795: Fixed handling of malicious HTTP splitting response headers in multiple modules (bsc#1222332).
CVE-2024-27316: Fixed HTTP/2 CONTINUATION frames that could have been utilized for DoS attacks (bsc#1221401).

Список пакетов

Image SLES15-SP3-SAPCAL-Azure

apache2-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-EC2-HVM

apache2-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-GCE

apache2-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

SUSE Enterprise Storage 7.1

apache2-2.4.51-150200.3.62.1

apache2-devel-2.4.51-150200.3.62.1

apache2-doc-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

apache2-worker-2.4.51-150200.3.62.1

SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS

apache2-2.4.51-150200.3.62.1

apache2-devel-2.4.51-150200.3.62.1

apache2-doc-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

apache2-worker-2.4.51-150200.3.62.1

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

apache2-2.4.51-150200.3.62.1

apache2-devel-2.4.51-150200.3.62.1

apache2-doc-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

apache2-worker-2.4.51-150200.3.62.1

SUSE Linux Enterprise Server 15 SP2-LTSS

apache2-2.4.51-150200.3.62.1

apache2-devel-2.4.51-150200.3.62.1

apache2-doc-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

apache2-worker-2.4.51-150200.3.62.1

SUSE Linux Enterprise Server 15 SP3-LTSS

apache2-2.4.51-150200.3.62.1

apache2-devel-2.4.51-150200.3.62.1

apache2-doc-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

apache2-worker-2.4.51-150200.3.62.1

SUSE Linux Enterprise Server for SAP Applications 15 SP2

apache2-2.4.51-150200.3.62.1

apache2-devel-2.4.51-150200.3.62.1

apache2-doc-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

apache2-worker-2.4.51-150200.3.62.1

SUSE Linux Enterprise Server for SAP Applications 15 SP3

apache2-2.4.51-150200.3.62.1

apache2-devel-2.4.51-150200.3.62.1

apache2-doc-2.4.51-150200.3.62.1

apache2-prefork-2.4.51-150200.3.62.1

apache2-utils-2.4.51-150200.3.62.1

apache2-worker-2.4.51-150200.3.62.1

Ссылки

https://www.suse.com/support/update/announcement/2024/suse-su-20241788-1/
Link for SUSE-SU-2024:1788-1
https://lists.suse.com/pipermail/sle-updates/2024-May/035366.html
E-Mail link for SUSE-SU-2024:1788-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1221401
SUSE Bug 1221401
https://bugzilla.suse.com/1222330
SUSE Bug 1222330
https://bugzilla.suse.com/1222332
SUSE Bug 1222332
https://www.suse.com/security/cve/CVE-2023-38709/
SUSE CVE CVE-2023-38709 page
https://www.suse.com/security/cve/CVE-2024-24795/
SUSE CVE CVE-2024-24795 page
https://www.suse.com/security/cve/CVE-2024-27316/
SUSE CVE CVE-2024-27316 page

Описание

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

Затронутые продукты

Image SLES15-SP3-SAPCAL-Azure:apache2-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-Azure:apache2-prefork-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-Azure:apache2-utils-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-EC2-HVM:apache2-2.4.51-150200.3.62.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-38709.html
CVE-2023-38709
https://bugzilla.suse.com/1222330
SUSE Bug 1222330

Описание

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

Затронутые продукты

Image SLES15-SP3-SAPCAL-Azure:apache2-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-Azure:apache2-prefork-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-Azure:apache2-utils-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-EC2-HVM:apache2-2.4.51-150200.3.62.1

Ссылки

https://www.suse.com/security/cve/CVE-2024-24795.html
CVE-2024-24795
https://bugzilla.suse.com/1222332
SUSE Bug 1222332

Описание

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Затронутые продукты

Image SLES15-SP3-SAPCAL-Azure:apache2-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-Azure:apache2-prefork-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-Azure:apache2-utils-2.4.51-150200.3.62.1

Image SLES15-SP3-SAPCAL-EC2-HVM:apache2-2.4.51-150200.3.62.1

Ссылки

https://www.suse.com/security/cve/CVE-2024-27316.html
CVE-2024-27316
https://bugzilla.suse.com/1221401
SUSE Bug 1221401

SUSE-SU-2024:1788-1

Описание

Список пакетов

Image SLES15-SP3-SAPCAL-Azure

Image SLES15-SP3-SAPCAL-EC2-HVM

Image SLES15-SP3-SAPCAL-GCE

SUSE Enterprise Storage 7.1

SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

SUSE Linux Enterprise Server 15 SP2-LTSS

SUSE Linux Enterprise Server 15 SP3-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP2

SUSE Linux Enterprise Server for SAP Applications 15 SP3

Ссылки

Уязвимость: CVE-2023-38709

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2024-24795

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2024-27316

Описание

Затронутые продукты

Ссылки