INFBA-2025:2973: mod_proxy_cluster security update
Information about definition
Identificator: INFBA-2025:2973
Type: bugfix
Release date: 2025-07-07 11:04:39 UTC
Information about package
The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.
Vulnerabilities description
- CVE-2024-10306
A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic. Bug Fixes * Rebuild mod_proxy_cluster against httpd 2.4.62 * Rebase mod_proxy_cluster to upstream 1.3.22 * Update deprecated misspeled EnableMCPMReceive directive
Severity level
| CVE | Score CVSS 2.0 | Score CVSS 3.x | Score CVSS 4.0 |
|---|---|---|---|
|
NIST — CVE-2024-10306
|
no information | 5.4 | no information |
Updated packages