Vulnerability CVE-2023-27522: Information

Description

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-27522
Published: March 7, 2023
Modified: Sept. 9, 2023
Error type identifier: CWE-444

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
apache2sisyphus2.4.56-alt12.4.59-alt1ALT-PU-2023-1402-1316442Fixed
apache2sisyphus_e2k2.4.56-alt12.4.59-alt1ALT-PU-2023-2833-1-Fixed
apache2sisyphus_riscv642.4.56-alt12.4.59-alt1ALT-PU-2023-2805-1-Fixed
apache2p102.4.56-alt12.4.59-alt1ALT-PU-2023-1452-1316447Fixed
apache2p10_e2k2.4.56-alt12.4.59-alt1ALT-PU-2023-2883-1-Fixed
apache2p92.4.57-alt22.4.58-alt1ALT-PU-2023-2055-1323347Fixed
apache2p9_e2k2.4.57-alt22.4.57-alt2ALT-PU-2023-5379-1-Fixed
apache2c10f12.4.56-alt12.4.59-alt1ALT-PU-2023-1452-1316447Fixed
apache2c9f22.4.56-alt12.4.59-alt1ALT-PU-2023-1437-1316469Fixed
uwsgisisyphus2.0.23-alt12.0.23-alt1ALT-PU-2023-7559-2335015Fixed
uwsgisisyphus_e2k2.0.23-alt12.0.23-alt1ALT-PU-2023-7609-1-Fixed
uwsgisisyphus_riscv642.0.23-alt12.0.23-alt1ALT-PU-2023-7605-1-Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://httpd.apache.org/security/vulnerabilities_24.html
  • Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
  • Third Party Advisory
https://security.gentoo.org/glsa/202309-01

      1. Configuration 1

        cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
        Start including
        2.4.30
        End including
        2.4.55

        Configuration 2

        cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

        Configuration 3

        cpe:2.3:a:unbit:uwsgi:*:*:*:*:*:*:*:*
        End excliding
        2.0.22
    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
    Version: v24.5.1
    Back to top