CVEvulnerability
CVE-2024-24795
6.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2024-04-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-113, CWE-444
Description
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.
Users are recommended to upgrade to version 2.4.59, which fixes this issue.
Affected configurations
• apache http server (>= 2.4.0 < 2.4.59)
• debian debian linux 10.0
• fedoraproject fedora 38
• fedoraproject fedora 39
• fedoraproject fedora 40
• netapp ontap 9
• netapp ontap tools 10
• broadcom fabric operating system
• apple macos (< 14.6)
Related
References
- https://httpd.apache.org/security/vulnerabilities_24.html Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List
- http://www.openwall.com/lists/oss-security/2024/04/04/5 Mailing List
- https://httpd.apache.org/security/vulnerabilities_24.html Release Notes, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/05/msg00014.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF/ Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ/ Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WNV4SZAPVS43DZWNFU7XBYYOZEZMI4ZC/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240415-0013/ Third Party Advisory
- https://support.apple.com/kb/HT214119 Third Party Advisory