Lucene search

IBM4CAF579E317551E36A9BE6CEA18C251A7DB80F46A99CCB082331C616D5D890D5

HistoryApr 10, 2024 - 6:17 p.m.

Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server (CVE-2023-38709, CVE-2024-24795)

2024-04-1018:17:52

www.ibm.com

ibm http server

ibm websphere remote server

security bulletin

vulnerabilities

fixes

http response splitting

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.5%

JSON

Summary

IBM HTTP Server is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM HTTP Server has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM WebSphere Remote Server	9.0, 8.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now. Refer to the following security bulletins for vulnerability details and information about fixes addressed by IBM HTTP Server which is shipped with IBM WebSphere Remote Server.

Principal Product and Version(s)

Affected Supporting Product and Version

Affected Supporting Product Security Bulletin

—|—|—

IBM WebSphere Remote Server 9.0, 8.5

IBM HTTP Server 9.0, 8.5

IBM HTTP Server is vulnerable to HTTP response splitting due to the included Apache HTTP Server (CVE-2024-24795, CVE-2023-38709)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwebsphere_remote_serverMatch9.0

ibmwebsphere_remote_serverMatch8.5

CPENameOperatorVersion
ibm websphere remote servereq9.0
ibm websphere remote servereq8.5

CPE	Name	Operator	Version
	ibm websphere remote server	eq	9.0
	ibm websphere remote server	eq	8.5