The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Aug 30, 2012 | Aug 22, 2012 |
| Suse | — | Upgrade apache2-workerUpgrade apache2Upgrade apache2-preforkUpgrade apache2-eventUpgrade apache2-example-pagesUpgrade apache2-utilsUpgrade apache2-develUpgrade apache2-docUpgrade apache2-manual | Aug 9, 2024 | Jun 28, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub