MGASA-2023-0032 - Updated apache packages fix security vulnerability

Publication date: 07 Feb 2023
URL: https://advisories.mageia.org/MGASA-2023-0032.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2006-20001,
     CVE-2022-36760,
     CVE-2022-37436

CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a
backend to trigger HTTP response splitting. Prior to 2.4.55, a malicious
backend can cause the response headers to be truncated early, resulting in
some headers being incorporated into the response body. If the later
headers have any security purpose, they will not be interpreted by the
client. Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)

CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request
smuggling. Inconsistent Interpretation of HTTP Requests ('HTTP Request
Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an
attacker to smuggle requests to the AJP server it forwards requests to.
Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec at
Qi'anxin Group

CVE-2006-20001: mod_dav out of  bounds read, or write of zero byte
A carefully crafted If: request header can cause a memory read, or write
of a single zero byte, in a pool (heap) memory location beyond the header
value sent. This could cause the process to crash.

References:
- https://bugs.mageia.org/show_bug.cgi?id=31427
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-20001
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36760
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37436

SRPMS:
- 8/core/apache-2.4.55-1.mga8