Описание
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | pending | 2.4.68-1ubuntu2 |
| esm-infra-legacy/trusty | released | 2.4.7-1ubuntu4.22+esm13 |
| esm-infra-legacy/xenial | released | 2.4.18-2ubuntu3.17+esm18 |
| esm-infra/bionic | released | 2.4.29-1ubuntu4.27+esm9 |
| esm-infra/focal | released | 2.4.41-4ubuntu3.23+esm4 |
| esm-infra/xenial | ignored | end of ESM support, was needs-triage |
| jammy | released | 2.4.52-1ubuntu4.20 |
| noble | released | 2.4.58-1ubuntu8.12 |
| questing | released | 2.4.64-1ubuntu3.4 |
| resolute | released | 2.4.66-2ubuntu2.1 |
Показывать по
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HT ...
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Уязвимость модуля mod_proxy_ajp() веб-сервера Apache HTTP Server, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
9.8 Critical
CVSS3