Search CVE reports

21 – 30 of 296 results

Detailed view

Sort by:

CVE-2024-27316

Medium priority

Some fixes available 8 of 9

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Fixed	Fixed	Fixed	Fixed

CVE-2024-28757

Medium priority

Some fixes available 2 of 81

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

23 affected packages

apache2, apr-util, ayttm, cableswig, cadaver...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
ayttm	Not in release	Not in release	Not in release	—
cableswig	Not in release	Not in release	Not in release	—
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
cmake	Not affected	Not affected	Not affected	Not affected
coin3	Not affected	Not affected	Not affected	Needs evaluation
expat	Not affected	Fixed	Ignored	Ignored
firefox	Not affected	Not affected	Not in release	—
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ghostscript	Not affected	Not affected	Not affected	Not affected
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
libxmltok	Ignored	Ignored	Ignored	Ignored
matanza	Ignored	Ignored	Ignored	Ignored
smart	Not in release	Not in release	Not in release	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
texlive-bin	Not affected	Not affected	Not affected	Not affected
thunderbird	Not affected	Not affected	Not in release	—
vnc4	Not in release	Not in release	Not in release	Needs evaluation
vtk	Not in release	Not in release	Not in release	—
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2024-24814

Medium priority

Vulnerable

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on...

1 affected package

libapache2-mod-auth-openidc

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
libapache2-mod-auth-openidc	Vulnerable	Vulnerable	Vulnerable	Vulnerable

CVE-2023-52426

Medium priority

Some fixes available 3 of 53

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

23 affected packages

apache2, apr-util, ayttm, cableswig, cadaver...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
ayttm	Not in release	Not in release	Not in release	Not in release
cableswig	Not in release	Not in release	Not in release	Not in release
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
cmake	Not affected	Not affected	Not affected	Not affected
coin3	Not affected	Not affected	Not affected	Needs evaluation
expat	Fixed	Not affected	Not affected	Not affected
firefox	Not affected	Not affected	Not in release	Ignored
gdcm	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
libxmltok	Not affected	Not affected	Not affected	Not affected
matanza	Ignored	Ignored	Ignored	Ignored
smart	Not in release	Not in release	Not in release	Not affected
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
texlive-bin	Not affected	Not affected	Not affected	Not affected
thunderbird	Not affected	Not affected	Not in release	Ignored
vnc4	Not in release	Not in release	Not in release	Not affected
vtk	Not in release	Not in release	Not in release	Not in release
wbxml2	Needs evaluation	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Not affected	Not affected	Not affected

CVE-2023-52425

Medium priority

Some fixes available 5 of 81

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

23 affected packages

apache2, apr-util, ayttm, cableswig, cadaver...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
ayttm	Not in release	Not in release	Not in release	Not in release
cableswig	Not in release	Not in release	Not in release	Not in release
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
cmake	Not affected	Not affected	Not affected	Not affected
coin3	Not affected	Not affected	Not affected	Needs evaluation
expat	Fixed	Fixed	Ignored	Ignored
firefox	Not affected	Not affected	Not in release	Ignored
gdcm	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
libxmltok	Ignored	Ignored	Ignored	Ignored
matanza	Ignored	Ignored	Ignored	Ignored
smart	Not in release	Not in release	Not in release	Not affected
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
texlive-bin	Not affected	Not affected	Not affected	Not affected
thunderbird	Not affected	Not affected	Not in release	Ignored
vnc4	Not in release	Not in release	Not in release	Needs evaluation
vtk	Not in release	Not in release	Not in release	Not in release
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2023-45802

Medium priority

Some fixes available 7 of 8

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request’s memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Fixed	Fixed	Fixed	Needs evaluation

CVE-2023-43622

Low priority

Fixed

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	—	Not affected	Not affected	Not affected

CVE-2023-31122

Low priority

Fixed

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	—	Fixed	Fixed	Fixed

CVE-2023-28625

Medium priority

Vulnerable

mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a...

1 affected package

libapache2-mod-auth-openidc

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
libapache2-mod-auth-openidc	Not affected	Vulnerable	Vulnerable	Vulnerable

CVE-2023-27522

Medium priority

Fixed

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	—	Fixed	Fixed	Not affected

Export to JSON

Results by page: