CVE-2023-25690

Publication date 7 March 2023

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule ”^/here/(.*)” “http://example.com:8080/elsewhere?$1”; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.

Read the notes from the security team

Status

Package Ubuntu Release Status
apache2 25.04 plucky
Fixed 2.4.55-1ubuntu2
24.10 oracular
Fixed 2.4.55-1ubuntu2
24.04 LTS noble
Fixed 2.4.55-1ubuntu2
23.10 mantic
Fixed 2.4.55-1ubuntu2
23.04 lunar
Fixed 2.4.55-1ubuntu2
22.10 kinetic
Fixed 2.4.54-2ubuntu1.2
22.04 LTS jammy
Fixed 2.4.52-1ubuntu4.4
20.04 LTS focal
Fixed 2.4.41-4ubuntu3.14
18.04 LTS bionic
Fixed 2.4.29-1ubuntu4.27
16.04 LTS xenial
14.04 LTS trusty
Vulnerable

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

mdeslaur

fixed by r1908095 in 2.4.x

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
apache2

Severity score breakdown

Parameter Value
Base score 9.8 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-5942-1
    • Apache HTTP Server vulnerabilities
    • 9 March 2023
    • USN-5942-2
    • Apache HTTP Server vulnerability
    • 22 March 2023

Other references