Описание
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needed | |
| esm-infra-legacy/trusty | released | 2.4.7-1ubuntu4.22+esm17 |
| esm-infra-legacy/xenial | released | 2.4.18-2ubuntu3.17+esm22 |
| esm-infra/bionic | released | 2.4.29-1ubuntu4.27+esm13 |
| esm-infra/focal | released | 2.4.41-4ubuntu3.23+esm9 |
| jammy | released | 2.4.52-1ubuntu4.25 |
| noble | released | 2.4.58-1ubuntu8.17 |
| resolute | released | 2.4.66-2ubuntu2.6 |
| stonking | needed | |
| upstream | released | 2.4.69-1 |
Показывать по
7.5 High
CVSS3
Связанные уязвимости
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apac ...
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
7.5 High
CVSS3