CVE-2024-24795

MEDIUM | Platform: macOS | Changelog

CVE Details

Description

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

Users are recommended to upgrade to version 2.4.59, which fixes this issue.

CVSS 3.1 Score

Metric	Value
Base Score	6.3 (MEDIUM)
Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L`

Weakness

References

Apple Security Advisory
NVD Entry
https://httpd.apache.org/security/vulnerabilities_24.html (Release Notes, Vendor Advisory)
http://seclists.org/fulldisclosure/2024/Jul/18 (Mailing List)
http://www.openwall.com/lists/oss-security/2024/04/04/5 (Mailing List)
https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html (Mailing List, Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2024/05/msg00014.html (Mailing List, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF/ (Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ/ (Third Party Advisory)