Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
172
security advisorydenial of servicesoftware fixUbuntu: USN-6729-1 Important Update for Apache HTTP Server Release
Several security issues were fixed in Apache HTTP Server.. ========================================================================== Ubuntu Security Notice USN-6729-1 April 11, 2024 apache2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in Apache HTTP Server. Software Description: - apache2: Apache HTTP server Details: Orange Tsai discovered that the Apache HTTP Server incorrectly handled validating certain input. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2023-38709) Keran Mu and Jianjun Chen discovered that the Apache HTTP Server incorrectly handled validating certain input. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2024-24795) Bartek Nowotarski discovered that the Apache HTTP Server HTTP/2 module incorrectly handled endless continuation frames. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. (CVE-2024-27316) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: apache2 2.4.57-2ubuntu2.4 Ubuntu 22.04 LTS: apache2 2.4.52-1ubuntu4.9 Ubuntu 20.04 LTS: apache2 2.4.41-4ubuntu3.17 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6729-1 CVE-2023-38709, CVE-2024-24795, CVE-2024-27316 Package Information: https://launchpad.net/ubuntu/+source/apache2/2.4.57-2ubuntu2.4 https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubuntu4.9 https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.17 . A range ofvulnerabilities addressed in Apache HTTP Server on Ubuntu, impacting various releases, including long-term support (LTS) editions.. Ubuntu Security Notice, Apache HTTP Server, security updates. . Severity: Important. LinuxSecurity.com Team
Apr 11, 2024
•Important
Ubuntu
98
security advisorysecurity fixhttpdRed Hat Enterprise Linux 9 RHSA-2023:1670-01 Important httpd Update
An update for httpd and mod_http2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: httpd and mod_http2 security update Advisory ID: RHSA-2023:1670-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1670 Issue date: 2023-04-06 CVE Names: CVE-2023-25690 ==================================================================== 1. Summary: An update for httpd and mod_http2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 2176209 - CVE-2023-25690 httpd: HTTP request splitting with mod_rewrite and mod_proxy 6. PackageList: Red Hat Enterprise Linux AppStream (v.9): Source: httpd-2.4.53-7.el9_1.5.src.rpm mod_http2-1.15.19-3.el9_1.5.src.rpm aarch64: httpd-2.4.53-7.el9_1.5.aarch64.rpm httpd-core-2.4.53-7.el9_1.5.aarch64.rpm httpd-core-debuginfo-2.4.53-7.el9_1.5.aarch64.rpm httpd-debuginfo-2.4.53-7.el9_1.5.aarch64.rpm httpd-debugsource-2.4.53-7.el9_1.5.aarch64.rpm httpd-devel-2.4.53-7.el9_1.5.aarch64.rpm httpd-tools-2.4.53-7.el9_1.5.aarch64.rpm httpd-tools-debuginfo-2.4.53-7.el9_1.5.aarch64.rpm mod_http2-1.15.19-3.el9_1.5.aarch64.rpm mod_http2-debuginfo-1.15.19-3.el9_1.5.aarch64.rpm mod_http2-debugsource-1.15.19-3.el9_1.5.aarch64.rpm mod_ldap-2.4.53-7.el9_1.5.aarch64.rpm mod_ldap-debuginfo-2.4.53-7.el9_1.5.aarch64.rpm mod_lua-2.4.53-7.el9_1.5.aarch64.rpm mod_lua-debuginfo-2.4.53-7.el9_1.5.aarch64.rpm mod_proxy_html-2.4.53-7.el9_1.5.aarch64.rpm mod_proxy_html-debuginfo-2.4.53-7.el9_1.5.aarch64.rpm mod_session-2.4.53-7.el9_1.5.aarch64.rpm mod_session-debuginfo-2.4.53-7.el9_1.5.aarch64.rpm mod_ssl-2.4.53-7.el9_1.5.aarch64.rpm mod_ssl-debuginfo-2.4.53-7.el9_1.5.aarch64.rpm noarch: httpd-filesystem-2.4.53-7.el9_1.5.noarch.rpm httpd-manual-2.4.53-7.el9_1.5.noarch.rpm ppc64le: httpd-2.4.53-7.el9_1.5.ppc64le.rpm httpd-core-2.4.53-7.el9_1.5.ppc64le.rpm httpd-core-debuginfo-2.4.53-7.el9_1.5.ppc64le.rpm httpd-debuginfo-2.4.53-7.el9_1.5.ppc64le.rpm httpd-debugsource-2.4.53-7.el9_1.5.ppc64le.rpm httpd-devel-2.4.53-7.el9_1.5.ppc64le.rpm httpd-tools-2.4.53-7.el9_1.5.ppc64le.rpm httpd-tools-debuginfo-2.4.53-7.el9_1.5.ppc64le.rpm mod_http2-1.15.19-3.el9_1.5.ppc64le.rpm mod_http2-debuginfo-1.15.19-3.el9_1.5.ppc64le.rpm mod_http2-debugsource-1.15.19-3.el9_1.5.ppc64le.rpm mod_ldap-2.4.53-7.el9_1.5.ppc64le.rpm mod_ldap-debuginfo-2.4.53-7.el9_1.5.ppc64le.rpm mod_lua-2.4.53-7.el9_1.5.ppc64le.rpm mod_lua-debuginfo-2.4.53-7.el9_1.5.ppc64le.rpm mod_proxy_html-2.4.53-7.el9_1.5.ppc64le.rpm mod_proxy_html-debuginfo-2.4.53-7.el9_1.5.ppc64le.rpm mod_session-2.4.53-7.el9_1.5.ppc64le.rpm mod_session-debuginfo-2.4.53-7.el9_1.5.ppc64le.rpm mod_ssl-2.4.53-7.el9_1.5.ppc64le.rpm mod_ssl-debuginfo-2.4.53-7.el9_1.5.ppc64le.rpm s390x: httpd-2.4.53-7.el9_1.5.s390x.rpm httpd-core-2.4.53-7.el9_1.5.s390x.rpm httpd-core-debuginfo-2.4.53-7.el9_1.5.s390x.rpm httpd-debuginfo-2.4.53-7.el9_1.5.s390x.rpm httpd-debugsource-2.4.53-7.el9_1.5.s390x.rpm httpd-devel-2.4.53-7.el9_1.5.s390x.rpm httpd-tools-2.4.53-7.el9_1.5.s390x.rpm httpd-tools-debuginfo-2.4.53-7.el9_1.5.s390x.rpm mod_http2-1.15.19-3.el9_1.5.s390x.rpm mod_http2-debuginfo-1.15.19-3.el9_1.5.s390x.rpm mod_http2-debugsource-1.15.19-3.el9_1.5.s390x.rpm mod_ldap-2.4.53-7.el9_1.5.s390x.rpm mod_ldap-debuginfo-2.4.53-7.el9_1.5.s390x.rpm mod_lua-2.4.53-7.el9_1.5.s390x.rpm mod_lua-debuginfo-2.4.53-7.el9_1.5.s390x.rpm mod_proxy_html-2.4.53-7.el9_1.5.s390x.rpm mod_proxy_html-debuginfo-2.4.53-7.el9_1.5.s390x.rpm mod_session-2.4.53-7.el9_1.5.s390x.rpm mod_session-debuginfo-2.4.53-7.el9_1.5.s390x.rpm mod_ssl-2.4.53-7.el9_1.5.s390x.rpm mod_ssl-debuginfo-2.4.53-7.el9_1.5.s390x.rpm x86_64: httpd-2.4.53-7.el9_1.5.x86_64.rpm httpd-core-2.4.53-7.el9_1.5.x86_64.rpm httpd-core-debuginfo-2.4.53-7.el9_1.5.x86_64.rpm httpd-debuginfo-2.4.53-7.el9_1.5.x86_64.rpm httpd-debugsource-2.4.53-7.el9_1.5.x86_64.rpm httpd-devel-2.4.53-7.el9_1.5.x86_64.rpm httpd-tools-2.4.53-7.el9_1.5.x86_64.rpm httpd-tools-debuginfo-2.4.53-7.el9_1.5.x86_64.rpm mod_http2-1.15.19-3.el9_1.5.x86_64.rpm mod_http2-debuginfo-1.15.19-3.el9_1.5.x86_64.rpm mod_http2-debugsource-1.15.19-3.el9_1.5.x86_64.rpm mod_ldap-2.4.53-7.el9_1.5.x86_64.rpm mod_ldap-debuginfo-2.4.53-7.el9_1.5.x86_64.rpm mod_lua-2.4.53-7.el9_1.5.x86_64.rpm mod_lua-debuginfo-2.4.53-7.el9_1.5.x86_64.rpm mod_proxy_html-2.4.53-7.el9_1.5.x86_64.rpm mod_proxy_html-debuginfo-2.4.53-7.el9_1.5.x86_64.rpm mod_session-2.4.53-7.el9_1.5.x86_64.rpm mod_session-debuginfo-2.4.53-7.el9_1.5.x86_64.rpm mod_ssl-2.4.53-7.el9_1.5.x86_64.rpm mod_ssl-debuginfo-2.4.53-7.el9_1.5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7.References: https://access.redhat.com/security/cve/CVE-2023-25690 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZDBH29zjgjWX9erEAQhFpw/9HSLo3H9yk8KOpnyrtD9alhqGMI4Uvw1O a6fRfNs6bD0ru8xdVJDjpXGOKTOgMW6p/zr789oAurWoEFr78mxPF68aliHjIA2v nvUNQtnvQmrGcVIWqbd0ANxBn9RMTnq7UoHLIkrbOwvpaKeb3cDPjry75qcjMaY0 59wDL+dAUg00uZnQTSMr31wT+LxyKOKwRQqGF5Jyrd8Hcctwg2K01fcHh6Cu15Hn TDKGj2hdOXYqkaO09UxxwAh2GzZiJLA/oxp+RnbZzmKkgoezS7CBLLkVjJBRwf3r uyFFgSZqntzx2oXoOGMqiMSwFcN9c9f0Ga2i8/BBMAYeNNGHyTIp/tXGUBjZDgdc Ti8EA0MijRynkwAhEdXDO0u42iA9aGNsDy0ny0CykaGwi4RRu1dJRAM7z3oXkrnm dl3ZSjqA0jWGkP0419sPaLubmLXz0gYsayFSu9HwuvaDwxF6hn7wGAhVVTq5thQJ NyOGWCNEvVq5M7er4aYlU4blz/iQOSlDWUjMLjGKZJ70K7yuVpFzg0Hol/EOAfqZ DvgYTVBOJ0SIoEgdG6emyuSWqZ7pGfDPEE+Yo3YUKWMXKBR6Gw+eIUs6mwX7GGG1 LtSP/q1u8dyPcXB1V+3D7Hgc/6vxR/ZXoWOrrdA6LaRVPAA4nupO7NpqImNz0sa2 z+8/qJuTlfY=zwk7 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Apr 07, 2023
•Important
Red Hat
217
security advisorycritical updatehttpdOracle Linux 9: ELSA-2023-1670 Critical: Httpd Http Request Splitting
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2023-1670 https://linux.oracle.com/errata/ELSA-2023-1670.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: httpd-2.4.53-7.0.1.el9_1.5.x86_64.rpm httpd-core-2.4.53-7.0.1.el9_1.5.x86_64.rpm httpd-devel-2.4.53-7.0.1.el9_1.5.x86_64.rpm httpd-filesystem-2.4.53-7.0.1.el9_1.5.noarch.rpm httpd-manual-2.4.53-7.0.1.el9_1.5.noarch.rpm httpd-tools-2.4.53-7.0.1.el9_1.5.x86_64.rpm mod_http2-1.15.19-3.el9_1.5.x86_64.rpm mod_ldap-2.4.53-7.0.1.el9_1.5.x86_64.rpm mod_lua-2.4.53-7.0.1.el9_1.5.x86_64.rpm mod_proxy_html-2.4.53-7.0.1.el9_1.5.x86_64.rpm mod_session-2.4.53-7.0.1.el9_1.5.x86_64.rpm mod_ssl-2.4.53-7.0.1.el9_1.5.x86_64.rpm aarch64: httpd-2.4.53-7.0.1.el9_1.5.aarch64.rpm httpd-core-2.4.53-7.0.1.el9_1.5.aarch64.rpm httpd-devel-2.4.53-7.0.1.el9_1.5.aarch64.rpm httpd-filesystem-2.4.53-7.0.1.el9_1.5.noarch.rpm httpd-manual-2.4.53-7.0.1.el9_1.5.noarch.rpm httpd-tools-2.4.53-7.0.1.el9_1.5.aarch64.rpm mod_http2-1.15.19-3.el9_1.5.aarch64.rpm mod_ldap-2.4.53-7.0.1.el9_1.5.aarch64.rpm mod_lua-2.4.53-7.0.1.el9_1.5.aarch64.rpm mod_proxy_html-2.4.53-7.0.1.el9_1.5.aarch64.rpm mod_session-2.4.53-7.0.1.el9_1.5.aarch64.rpm mod_ssl-2.4.53-7.0.1.el9_1.5.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol9/SRPMS-updates//httpd-2.4.53-7.0.1.el9_1.5.src.rpm https://oss.oracle.com:443/ol9/SRPMS-updates//mod_http2-1.15.19-3.el9_1.5.src.rpm Related CVEs: CVE-2023-25690 Description of changes: httpd [2.4.53-7.0.1.5] - Replace index.html with Oracle's index page oracle_index.html. [2.4.53-7.5] - Resolves: #2177751 - CVE-2023-25690 httpd: HTTP request splitting with mod_rewrite and mod_proxy mod_http2 [1.15.19-3.5] - Resolves: #2177751 - CVE-2023-25690 httpd: HTTP request splitting with mod_rewrite and mod_proxy [1.15.19-3] - Resolves: #2066311 - CVE-2021-44224 httpd: possible NULL dereference or SSRF in forward proxyconfigurations _______________________________________________ El-errata mailing list
Apr 06, 2023
•Critical
Oracle
202
security advisorydenial of servicepatchopenSUSE: 2019:0088-1 Important: Nodejs4 Denial of Service Fix
An update that fixes 7 vulnerabilities is now available.. openSUSE Security Update: Security update for nodejs4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0088-1 Rating: important References: #1113534 #1113652 #1117625 #1117626 #1117627 #1117629 #1117630 Cross-References: CVE-2018-0734 CVE-2018-12116 CVE-2018-12120 CVE-2018-12121 CVE-2018-12122 CVE-2018-12123 CVE-2018-5407 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652) - CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka "PortSmash") (bsc#1113534) - CVE-2018-12120: Fixed that the debugger listens on any interface by default (bsc#1117625) - CVE-2018-12121: Fixed a denial of Service with large HTTP headers (bsc#1117626) - CVE-2018-12122: Fixed the "Slowloris" HTTP Denial of Service (bsc#1117627) - CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630) - CVE-2018-12123: Fixed hostname spoofing in URL parser for javascript protocol (bsc#1117629) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-88=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs4-4.9.1-20.1 nodejs4-debuginfo-4.9.1-20.1 nodejs4-debugsource-4.9.1-20.1 nodejs4-devel-4.9.1-20.1 npm4-4.9.1-20.1 - openSUSE Leap 42.3 (noarch): nodejs4-docs-4.9.1-20.1 References: https://www.suse.com/security/cve/CVE-2018-0734.html https://www.suse.com/security/cve/CVE-2018-12116.html https://www.suse.com/security/cve/CVE-2018-12120.html https://www.suse.com/security/cve/CVE-2018-12121.html https://www.suse.com/security/cve/CVE-2018-12122.html https://www.suse.com/security/cve/CVE-2018-12123.html https://www.suse.com/security/cve/CVE-2018-5407.html https://bugzilla.suse.com/1113534 https://bugzilla.suse.com/1113652 https://bugzilla.suse.com/1117625 https://bugzilla.suse.com/1117626 https://bugzilla.suse.com/1117627 https://bugzilla.suse.com/1117629 https://bugzilla.suse.com/1117630 -- . Crucial enhancement released for nodejs4 on openSUSE addressing 7 vulnerabilities. It's advised to apply the necessary updates immediately.. openSUSE Update, nodejs Patch, Important Security Fixes, Denial of Service, Security Vulnerabilities. . Severity: Important. LinuxSecurity.com Team
Jan 25, 2019
•Important
OpenSUSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!