(RHSA-2024:3121) Moderate: httpd:2.4 security update

2024-05-2206:35:40

access.redhat.com

rhsa-2024-3121

moderate

apache http server

mod_macro

out-of-bounds read vulnerability

mod_http2

reset requests exhaust memory

cve-2023-31122

cve-2023-44487

cve-2023-45802

cvss score

red hat enterprise linux 8.10

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

Low

EPSS

0.816

Percentile

98.4%

JSON

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: mod_macro: out-of-bounds read vulnerability (CVE-2023-31122)
mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyaarch64mod_session-debuginfo< 2.4.37-64.module+el8.10.0+21332+dfb1b40emod_session-debuginfo-2.4.37-64.module+el8.10.0+21332+dfb1b40e.aarch64.rpm
RedHatanyaarch64mod_md-debugsource< 2.0.8-8.module+el8.9.0+19080+567b90f8mod_md-debugsource-2.0.8-8.module+el8.9.0+19080+567b90f8.aarch64.rpm
RedHatanyx86_64httpd-debugsource< 2.4.37-64.module+el8.10.0+21332+dfb1b40ehttpd-debugsource-2.4.37-64.module+el8.10.0+21332+dfb1b40e.x86_64.rpm
RedHatanyppc64lemod_http2-debuginfo< 1.15.7-10.module+el8.10.0+21653+eaff63f0mod_http2-debuginfo-1.15.7-10.module+el8.10.0+21653+eaff63f0.ppc64le.rpm
RedHatanyppc64lemod_proxy_html-debuginfo< 2.4.37-64.module+el8.10.0+21332+dfb1b40emod_proxy_html-debuginfo-2.4.37-64.module+el8.10.0+21332+dfb1b40e.ppc64le.rpm
RedHatanyaarch64mod_proxy_html< 2.4.37-64.module+el8.10.0+21332+dfb1b40emod_proxy_html-2.4.37-64.module+el8.10.0+21332+dfb1b40e.aarch64.rpm
RedHatanys390xmod_proxy_html-debuginfo< 2.4.37-64.module+el8.10.0+21332+dfb1b40emod_proxy_html-debuginfo-2.4.37-64.module+el8.10.0+21332+dfb1b40e.s390x.rpm
RedHatanyx86_64mod_md-debuginfo< 2.0.8-8.module+el8.9.0+19080+567b90f8mod_md-debuginfo-2.0.8-8.module+el8.9.0+19080+567b90f8.x86_64.rpm
RedHatanyppc64lemod_http2< 1.15.7-10.module+el8.10.0+21653+eaff63f0mod_http2-1.15.7-10.module+el8.10.0+21653+eaff63f0.ppc64le.rpm
RedHatanyaarch64mod_ssl< 2.4.37-64.module+el8.10.0+21332+dfb1b40emod_ssl-2.4.37-64.module+el8.10.0+21332+dfb1b40e.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	aarch64	mod_session-debuginfo	< 2.4.37-64.module+el8.10.0+21332+dfb1b40e	mod_session-debuginfo-2.4.37-64.module+el8.10.0+21332+dfb1b40e.aarch64.rpm
RedHat	any	aarch64	mod_md-debugsource	< 2.0.8-8.module+el8.9.0+19080+567b90f8	mod_md-debugsource-2.0.8-8.module+el8.9.0+19080+567b90f8.aarch64.rpm
RedHat	any	x86_64	httpd-debugsource	< 2.4.37-64.module+el8.10.0+21332+dfb1b40e	httpd-debugsource-2.4.37-64.module+el8.10.0+21332+dfb1b40e.x86_64.rpm
RedHat	any	ppc64le	mod_http2-debuginfo	< 1.15.7-10.module+el8.10.0+21653+eaff63f0	mod_http2-debuginfo-1.15.7-10.module+el8.10.0+21653+eaff63f0.ppc64le.rpm
RedHat	any	ppc64le	mod_proxy_html-debuginfo	< 2.4.37-64.module+el8.10.0+21332+dfb1b40e	mod_proxy_html-debuginfo-2.4.37-64.module+el8.10.0+21332+dfb1b40e.ppc64le.rpm
RedHat	any	aarch64	mod_proxy_html	< 2.4.37-64.module+el8.10.0+21332+dfb1b40e	mod_proxy_html-2.4.37-64.module+el8.10.0+21332+dfb1b40e.aarch64.rpm
RedHat	any	s390x	mod_proxy_html-debuginfo	< 2.4.37-64.module+el8.10.0+21332+dfb1b40e	mod_proxy_html-debuginfo-2.4.37-64.module+el8.10.0+21332+dfb1b40e.s390x.rpm
RedHat	any	x86_64	mod_md-debuginfo	< 2.0.8-8.module+el8.9.0+19080+567b90f8	mod_md-debuginfo-2.0.8-8.module+el8.9.0+19080+567b90f8.x86_64.rpm
RedHat	any	ppc64le	mod_http2	< 1.15.7-10.module+el8.10.0+21653+eaff63f0	mod_http2-1.15.7-10.module+el8.10.0+21653+eaff63f0.ppc64le.rpm
RedHat	any	aarch64	mod_ssl	< 2.4.37-64.module+el8.10.0+21332+dfb1b40e	mod_ssl-2.4.37-64.module+el8.10.0+21332+dfb1b40e.aarch64.rpm