USN-5834-1: Apache HTTP Server vulnerabilities
31 January 2023
Several security issues were fixed in Apache HTTP Server.
Releases
Packages
- apache2 - Apache HTTP server
Details
It was discovered that the Apache HTTP Server mod_dav module did not
properly handle specially crafted request headers. A remote attacker
could possibly use this issue to cause the process to crash, leading
to a denial of service. (CVE-2006-20001)
It was discovered that the Apache HTTP Server mod_proxy_ajp module did not
properly handle certain invalid Transfer-Encoding headers. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-36760)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
apache2
-
2.4.18-2ubuntu3.17+esm8
Available with Ubuntu Pro
-
apache2-bin
-
2.4.18-2ubuntu3.17+esm8
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5839-1: libapache2-mod-md, libapache2-mod-proxy-uwsgi, apache2, apache2-data, apache2-bin, apache2-suexec-custom, apache2-suexec-pristine, apache2-utils, apache2-dev, apache2-doc, apache2-ssl-dev