Search for packages
| purl | pkg:apache/httpd@2.4.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2013-5704
|
HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that … |
Vulnerable Vulnerable |
|
CVE-2014-0117
|
A flaw was found in mod_proxy in httpd versions 2.4.6 to 2.4.9. A remote attacker could send a carefully crafted … |
Vulnerable |
|
CVE-2014-0118
|
A resource consumption flaw was found in mod_deflate. If request body decompression was configured (using the "DEFLATE" input filter), a … |
Vulnerable Vulnerable |
|
CVE-2014-0226
|
A race condition was found in mod_status. An attacker able to access a public server status page on a server … |
Vulnerable Vulnerable |
|
CVE-2014-0231
|
A flaw was found in mod_cgid. If a server using mod_cgid hosted CGI scripts which did not consume standard input, … |
Vulnerable Vulnerable |
|
CVE-2014-3523
|
A flaw was found in the WinNT MPM in httpd versions 2.4.1 to 2.4.9, when using the default AcceptFilter for … |
Vulnerable |
|
CVE-2014-3581
|
A NULL pointer deference was found in mod_cache. A malicious HTTP server could cause a crash in a caching forward … |
Vulnerable |
|
CVE-2014-8109
|
Fix handling of the Require line in mod_lua when a LuaAuthzProvider is used in multiple Require directives with different arguments. … |
Vulnerable |
|
CVE-2015-0228
|
A stack recursion crash in the mod_lua module was found. A Lua script executing the r:wsupgrade() function could crash the … |
Vulnerable |
|
CVE-2015-3183
|
An HTTP request smuggling attack was possible due to a bug in parsing of chunked requests. A malicious client could … |
Vulnerable Vulnerable |
|
CVE-2015-3185
|
A design error in the "ap_some_auth_required" function renders the API unusuable in httpd 2.4.x. In particular the API is documented … |
Vulnerable |
|
CVE-2016-0736
|
Prior to Apache HTTP release 2.4.25, mod_sessioncrypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or … |
Vulnerable |
|
CVE-2016-2161
|
Malicious input to mod_auth_digest will cause the server to crash, and each instance continues to crash even for subsequently valid … |
Vulnerable |
|
CVE-2016-4975
|
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made … |
Vulnerable Vulnerable |
|
CVE-2016-5387
|
HTTP_PROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to … |
Vulnerable Vulnerable |
|
CVE-2016-8743
|
Apache HTTP Server, prior to release 2.4.25 (and 2.2.32), accepted a broad pattern of unusual whitespace patterns from the user-agent, … |
Vulnerable Vulnerable |
|
CVE-2017-15710
|
mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's … |
Vulnerable |
|
CVE-2017-15715
|
The expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only … |
Vulnerable |
|
CVE-2017-3167
|
Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Third-party … |
Vulnerable Vulnerable |
|
CVE-2017-3169
|
mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. |
Vulnerable Vulnerable |
|
CVE-2017-7679
|
mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. |
Vulnerable Vulnerable |
|
CVE-2017-9788
|
The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. … |
Vulnerable Vulnerable |
|
CVE-2017-9798
|
When an unrecognized HTTP Method is given in an <Limit {method}> directive in an .htaccess file, and that .htaccess file … |
Vulnerable |
|
CVE-2018-1283
|
When mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user … |
Vulnerable |
|
CVE-2018-1301
|
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.33, due to an out of … |
Vulnerable |
|
CVE-2018-1303
|
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.33 due to an … |
Vulnerable |
|
CVE-2018-1312
|
When generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a … |
Vulnerable |
|
CVE-2018-17199
|
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This … |
Vulnerable |
|
CVE-2019-0217
|
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server … |
Vulnerable |
|
CVE-2019-0220
|
When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must … |
Vulnerable |
|
CVE-2019-10092
|
A limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the … |
Vulnerable |
|
CVE-2019-10098
|
Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to … |
Vulnerable |
|
CVE-2019-17567
|
Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin … |
Vulnerable |
|
CVE-2020-11985
|
For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and … |
Vulnerable |
|
CVE-2020-13938
|
Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows |
Vulnerable |
|
CVE-2020-1927
|
In Apache HTTP Server versions 2.4.0 to 2.4.41 some mod_rewrite configurations vulnerable to open redirect. |
Not vulnerable |
|
CVE-2020-1934
|
in Apache HTTP Server versions 2.4.0 to 2.4.41, mod_proxy_ftp use of uninitialized value with malicious FTP backend. |
Not vulnerable |
|
CVE-2020-35452
|
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There … |
Vulnerable |
|
CVE-2021-26690
|
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer … |
Vulnerable |
|
CVE-2021-26691
|
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted SessionHeader sent by an origin server could cause a heap … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2013-6438
|
XML parsing code in mod_dav incorrectly calculates the end of the string when removing leading spaces and places a NUL … | |
|
CVE-2014-0098
|
A flaw was found in mod_log_config. A remote attacker could send a specific truncated cookie causing a crash. This crash … |