Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
redhatRedHatRHSA-2024:2891
HistoryMay 16, 2024 - 11:37 a.m.

(RHSA-2024:2891) Moderate: httpd:2.4 security update

2024-05-1611:37:17
access.redhat.com
13
httpd
apache http server
security update
mod_http2
cve-2024-27316
cve-2023-44487
cve-2023-45802

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

Low

EPSS

0.816

Percentile

98.4%

JSON

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and
extensible web server.

Security Fix(es):

  • mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316)

  • mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyaarch64mod_ldap< 2.4.37-56.module+el8.8.0+19808+379766d6.7mod_ldap-2.4.37-56.module+el8.8.0+19808+379766d6.7.aarch64.rpm
RedHatanyppc64lehttpd< 2.4.37-56.module+el8.8.0+19808+379766d6.7httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.ppc64le.rpm
RedHatanyx86_64mod_md-debuginfo< 2.0.8-8.module+el8.3.0+6814+67d1e611mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
RedHatanyaarch64mod_proxy_html< 2.4.37-56.module+el8.8.0+19808+379766d6.7mod_proxy_html-2.4.37-56.module+el8.8.0+19808+379766d6.7.aarch64.rpm
RedHatanyx86_64mod_ldap< 2.4.37-56.module+el8.8.0+19808+379766d6.7mod_ldap-2.4.37-56.module+el8.8.0+19808+379766d6.7.x86_64.rpm
RedHatanyx86_64httpd-debuginfo< 2.4.37-56.module+el8.8.0+19808+379766d6.7httpd-debuginfo-2.4.37-56.module+el8.8.0+19808+379766d6.7.x86_64.rpm
RedHatanyaarch64mod_ssl-debuginfo< 2.4.37-56.module+el8.8.0+19808+379766d6.7mod_ssl-debuginfo-2.4.37-56.module+el8.8.0+19808+379766d6.7.aarch64.rpm
RedHatanys390xmod_http2-debuginfo< 1.15.7-8.module+el8.8.0+21773+20528f83.5mod_http2-debuginfo-1.15.7-8.module+el8.8.0+21773+20528f83.5.s390x.rpm
RedHatanyx86_64mod_http2-debugsource< 1.15.7-8.module+el8.8.0+21773+20528f83.5mod_http2-debugsource-1.15.7-8.module+el8.8.0+21773+20528f83.5.x86_64.rpm
RedHatanyx86_64httpd-devel< 2.4.37-56.module+el8.8.0+19808+379766d6.7httpd-devel-2.4.37-56.module+el8.8.0+19808+379766d6.7.x86_64.rpm
Rows per page:
1-10 of 821

Related

nessus 70
vulnrichment 2
openvas 39
osv 18
f5 2
alpinelinux 2
attackerkb 1
debiancve 2
cve 2
ubuntucve 2
cvelist 2
redhatcve 2
nvd 2
fedora 6
prion 1
redhat 10
almalinux 5
rocky 3
cbl_mariner 6
veracode 2
redos 2
ibm 5
oraclelinux 5
hackerone 1
amazon 2
githubexploit 1
mageia 1
debian 2
atlassian 1
nessus
nessus
RHEL 8 : httpd:2.4 (RHSA-2024:2891)
2024-05-16 00:00:00
Fedora 39 : mod_http2 (2023-492b7be466)
2023-11-07 00:00:00
Fedora 37 : mod_http2 (2023-c0c6a91330)
2023-11-07 00:00:00
vulnrichment
vulnrichment
CVE-2023-45802 Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
2023-10-23 06:50:23
CVE-2024-27316 Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
2024-04-04 19:21:41
openvas
openvas
Apache HTTP Server 2.4.17 - 2.4.57 DoS Vulnerability - Windows
2023-10-19 00:00:00
Fedora: Security Advisory for mod_http2 (FEDORA-2023-c0c6a91330)
2023-11-08 00:00:00
Fedora: Security Advisory (FEDORA-2023-492b7be466)
2023-11-07 00:00:00
osv
osv
BIT-2023-45802
2023-11-02 07:16:21
BIT-apache-2023-45802
2024-03-06 10:50:33
CVE-2023-45802
2023-10-23 07:15:11
f5
f5
K000137327 : Apache mod_http2 vulnerability CVE-2023-45802
2023-10-23 00:00:00
K000139214 : Apache httpd vulnerability CVE-2024-27316
2024-04-08 00:00:00
alpinelinux
alpinelinux
CVE-2023-45802
2023-10-23 07:15:11
CVE-2024-27316
2024-04-04 20:15:08
attackerkb
attackerkb
CVE-2023-44487
2023-10-10 00:00:00
debiancve
debiancve
CVE-2023-45802
2023-10-23 07:15:11
CVE-2024-27316
2024-04-04 20:15:08
cve
cve
CVE-2023-45802
2023-10-23 07:15:11
CVE-2024-27316
2024-04-04 20:15:08
ubuntucve
ubuntucve
CVE-2023-45802
2023-10-23 00:00:00
CVE-2024-27316
2024-03-27 00:00:00
cvelist
cvelist
CVE-2023-45802 Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
2023-10-23 06:50:23
CVE-2024-27316 Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
2024-04-04 19:21:41
redhatcve
redhatcve
CVE-2023-45802
2023-10-19 19:44:57
CVE-2024-27316
2024-04-03 19:27:03
nvd
nvd
CVE-2023-45802
2023-10-23 07:15:11
CVE-2024-27316
2024-04-04 20:15:08
fedora
fedora
[SECURITY] Fedora 38 Update: mod_http2-2.0.25-1.fc38
2023-10-24 01:23:54
[SECURITY] Fedora 37 Update: mod_http2-2.0.25-1.fc37
2023-11-07 02:32:37
[SECURITY] Fedora 39 Update: mod_http2-2.0.25-1.fc39
2023-11-07 01:40:03
prion
prion
Design/Logic Flaw
2023-10-23 07:15:00
redhat
redhat
(RHSA-2024:3121) Moderate: httpd:2.4 security update
2024-05-22 06:35:40
(RHSA-2024:2368) Moderate: mod_http2 security update
2024-04-30 06:15:30
(RHSA-2024:1872) Important: mod_http2 security update
2024-04-18 00:58:11
almalinux
almalinux
Moderate: mod_http2 security update
2024-04-30 00:00:00
Moderate: httpd:2.4 security update
2024-05-22 00:00:00
Moderate: mod_http2 security update
2024-04-30 00:00:00
rocky
rocky
httpd:2.4 security update
2024-06-14 13:59:30
httpd:2.4/mod_http2 security update
2024-05-06 13:04:21
mod_http2 security update
2024-05-10 14:32:42
cbl_mariner
cbl_mariner
CVE-2023-45802 affecting package httpd for versions less than 2.4.58-1
2023-11-08 02:07:28
CVE-2024-27316 affecting package httpd for versions less than 2.4.61-1
2024-08-14 20:43:58
CVE-2024-27316 affecting package httpd for versions less than 2.4.59-1
2024-05-06 17:48:02
veracode
veracode
Denial Of Service (DoS)
2023-10-20 07:48:32
Memory Exhaustion
2024-04-10 19:25:29
redos
redos
ROS-20240425-01
2024-04-25 00:00:00
ROS-20240806-10
2024-08-06 00:00:00
ibm
ibm
Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to a denial of service attack using HTTP/2 protocol. [CVE-2024-27316]
2024-06-25 23:52:39
Security Bulletin: IBM Aspera Console has addressed a denial of service vulnerability (CVE-2024-27316)
2024-05-29 21:22:20
Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to an attacker uploading arbitrary files and obtaining sensitive information (CVE-2023-45802, CVE-2023-31122)
2024-02-16 21:57:19
oraclelinux
oraclelinux
mod_http2 security update
2024-04-18 00:00:00
mod_http2 security update
2024-05-07 00:00:00
httpd:2.4/mod_http2 security update
2024-04-11 00:00:00
hackerone
hackerone
Internet Bug Bounty: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
2024-04-08 20:33:40
amazon
amazon
Important: mod_http2
2024-04-24 22:15:00
Important: httpd24
2024-04-25 16:04:00
githubexploit
githubexploit
Exploit for Allocation of Resources Without Limits or Throttling in Apache Http Server
2024-04-17 20:08:05
mageia
mageia
Updated apache packages fix security vulnerabilities
2023-10-28 00:49:40
debian
debian
[SECURITY] [DSA 5662-1] apache2 security update
2024-04-16 18:32:07
[SECURITY] [DLA 3818-1] apache2 security update
2024-05-25 11:06:45
atlassian
atlassian
DoS (Denial of Service) io.netty:netty-codec-http2 in Confluence Data Center and Server
2023-11-03 00:45:12

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

Low

EPSS

0.816

Percentile

98.4%

JSON
Related for RHSA-2024:2891
nessus70vulnrichment2openvas39osv18f52alpinelinux2attackerkb1debiancve2cve2ubuntucve2cvelist2redhatcve2nvd2fedora6prion1redhat10almalinux5rocky3cbl_mariner6veracode2redos2ibm5oraclelinux5hackerone1amazon2githubexploit1mageia1debian2atlassian1