Debian 10 Buster DLA-3818-1 Moderate: Apache HTTP Server Issues

CVE-2019-17567

mod_proxy_wstunnel configured on an URL that is not
necessarily Upgraded by the origin server was tunneling
the whole connection regardless, thus allowing for subsequent requests
on the same connection to pass through with no HTTP validation,
authentication or authorization possibly configured.

CVE-2023-31122

An Out-of-bounds Read vulnerability was found in mod_macro.

CVE-2023-38709

A faulty input validation was found in the core of Apache
that allows malicious or exploitable backend/content generators
to split HTTP responses.

CVE-2023-45802

When an HTTP/2 stream was reset (RST frame) by a client, there was a
time window were the request's memory resources were not reclaimed
immediately. Instead, de-allocation was deferred to connection close.
A client could send new requests and resets, keeping the connection
busy and open and causing the memory footprint to keep on growing.