UbuntuUpdates.org

Package "libapache2-mod-proxy-uwsgi"

Name: libapache2-mod-proxy-uwsgi

Description:

transitional package
Latest version: 2.4.57-2ubuntu2.4
Release: mantic (23.10)
Level: security
Repository: universe
Head package: apache2
Homepage: https://httpd.apache.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libapache2-mod-proxy-uwsgi"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libapache2-mod-proxy-uwsgi" in Mantic

Repository Area Version
base universe 2.4.57-2ubuntu2
updates universe 2.4.57-2ubuntu2.4

Changelog

Version: 2.4.57-2ubuntu2.4 2024-04-11 18:06:59 UTC

  apache2 (2.4.57-2ubuntu2.4) mantic-security; urgency=medium

  * SECURITY UPDATE: HTTP response splitting
    - debian/patches/CVE-2023-38709.patch: header validation after
      content-* are eval'ed in modules/http/http_filters.c.
    - CVE-2023-38709
  * SECURITY UPDATE: HTTP Response Splitting in multiple modules
    - debian/patches/CVE-2024-24795.patch: let httpd handle CL/TE for
      non-http handlers in include/util_script.h,
      modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c,
      modules/generators/mod_cgid.c, modules/http/http_filters.c,
      modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c,
      modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2024-24795
  * SECURITY UPDATE: HTTP/2 DoS by memory exhaustion on endless
    continuation frames
    - debian/patches/CVE-2024-27316.patch: bail after too many failed reads
      in modules/http2/h2_session.c, modules/http2/h2_stream.c,
      modules/http2/h2_stream.h.
    - CVE-2024-27316

 -- Marc Deslauriers <email address hidden> Wed, 10 Apr 2024 13:41:02 -0400
Source diff to previous version
CVE-2023-38709 Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects
CVE-2024-24795 HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applicat
CVE-2024-27316 HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client do

Version: 2.4.57-2ubuntu2.1 2023-11-22 16:07:10 UTC

  apache2 (2.4.57-2ubuntu2.1) mantic-security; urgency=medium

  * SECURITY UPDATE: mod_macro buffer over-read
    - debian/patches/CVE-2023-31122.patch: fix length in
      modules/core/mod_macro.c.
    - CVE-2023-31122
  * SECURITY UPDATE: Multiple issues in HTTP/2
    - CVE-2023-43622: DoS in HTTP/2 with initial windows size 0
    - CVE-2023-45802: HTTP/2 stream memory not reclaimed right away on RST
    - debian/patches/update_http2.patch: backport version 2.0.22 of
      mod_http2 from httpd 2.4.58.
    - CVE-2023-43622
    - CVE-2023-45802

 -- Marc Deslauriers <email address hidden> Thu, 26 Oct 2023 09:28:30 -0400


About   -   Send Feedback to @ubuntu_updates