Security update for apache2
This update for apache2 fixes the following issues: - CVE-2022-37436: Fixed an issue in mod_proxy where a malicious backend could cause the response headers to be truncated early, resulting in some headers being incorporated into the response body (bsc#1207251). - CVE-2022-36760: Fixed an issue in mod_proxy_ajp that could allow request smuggling attacks (bsc#1207250). - CVE-2006-20001: Fixed an issue in mod_proxy_ajp where a request header could cause memory corruption (bsc#1207247).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for apache2 fixes the following issues: - CVE-2022-37436: Fixed an issue in mod_proxy where a malicious backend could cause the response headers to be truncated early, resulting in some headers being incorporated into the response body (bsc#1207251). - CVE-2022-36760: Fixed an issue in mod_proxy_ajp that could allow request smuggling attacks (bsc#1207250). - CVE-2006-20001: Fixed an issue in mod_proxy_ajp where a request header could cause memory corruption (bsc#1207247).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1207247
- https://bugzilla.suse.com/1207250
- https://bugzilla.suse.com/1207251
- https://www.suse.com/security/cve/CVE-2006-20001
- https://www.suse.com/security/cve/CVE-2022-36760
- https://www.suse.com/security/cve/CVE-2022-37436
- https://www.suse.com/support/update/announcement/2023/suse-su-20230321-1/