INFSA-2024:3121: httpd:2.4 security update
Information about definition
Identificator: INFSA-2024:3121
Type: security
Release date: 2024-10-10 06:01:40 UTC
Information about package
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Vulnerabilities description
- CVE-2023-31122
Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.
- CVE-2023-45802
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.
Severity level
| CVE | Score CVSS 2.0 | Score CVSS 3.x | Score CVSS 4.0 |
|---|---|---|---|
|
NIST — CVE-2023-31122
|
no information | 7.5 | no information |
|
NIST — CVE-2023-45802
|
no information | 7.5 | no information |
Updated packages