Описание
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | not-affected | 2.0.55-4ubuntu2.11 |
| devel | not-affected | 2.2.16-3ubuntu1 |
| hardy | not-affected | 2.2.8-1ubuntu0.18 |
| jaunty | ignored | end of life |
| karmic | not-affected | 2.2.12-1ubuntu2.3 |
| lucid | not-affected | 2.2.14-5ubuntu8.3 |
| maverick | not-affected | 2.2.16-1ubuntu3 |
| upstream | released | 2.2.10 |
Показывать по
EPSS
5 Medium
CVSS2
Связанные уязвимости
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, ...
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
ELSA-2010-0659: httpd security and bug fix update (MODERATE)
EPSS
5 Medium
CVSS2