CVE-2023-38709
Published: 4 April 2024
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
apache2
Launchpad, Ubuntu, Debian |
bionic |
Released
(2.4.29-1ubuntu4.27+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
| focal |
Released
(2.4.41-4ubuntu3.17)
|
|
| jammy |
Released
(2.4.52-1ubuntu4.9)
|
|
| mantic |
Released
(2.4.57-2ubuntu2.4)
|
|
| noble |
Released
(2.4.58-1ubuntu8.1)
|
|
| trusty |
Needs triage
|
|
| upstream |
Released
(2.4.59-1)
|
|
| xenial |
Released
(2.4.18-2ubuntu3.17+esm12)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
|
Patches:
upstream: https://svn.apache.org/viewvc?view=revision&revision=1916770 upstream: https://github.com/apache/httpd/commit/ac20389f3c816d990aba21720f1492b69ac5cb44 |
||
References
- https://www.openwall.com/lists/oss-security/2024/04/04/3
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-38709
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://ubuntu.com/security/notices/USN-6729-1
- https://www.cve.org/CVERecord?id=CVE-2023-38709
- https://ubuntu.com/security/notices/USN-6729-2
- https://ubuntu.com/security/notices/USN-6729-3
- NVD
- Launchpad
- Debian