OESA-2023-1161

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1161
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2023-1161.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2023-1161
Upstream
Published
2023-03-17T11:05:02Z
Modified
2025-08-12T05:18:53.856243Z
Summary
httpd security update
Details

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.(CVE-2023-27522)

Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.(CVE-2023-25690)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / httpd

Package

Name
httpd
Purl
pkg:rpm/openEuler/httpd&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.43-21.oe1

Ecosystem specific 

{
    "src": [
        "httpd-2.4.43-21.oe1.src.rpm"
    ],
    "x86_64": [
        "httpd-debuginfo-2.4.43-21.oe1.x86_64.rpm",
        "httpd-tools-2.4.43-21.oe1.x86_64.rpm",
        "httpd-devel-2.4.43-21.oe1.x86_64.rpm",
        "mod_ssl-2.4.43-21.oe1.x86_64.rpm",
        "mod_proxy_html-2.4.43-21.oe1.x86_64.rpm",
        "mod_session-2.4.43-21.oe1.x86_64.rpm",
        "mod_ldap-2.4.43-21.oe1.x86_64.rpm",
        "httpd-2.4.43-21.oe1.x86_64.rpm",
        "httpd-debugsource-2.4.43-21.oe1.x86_64.rpm",
        "mod_md-2.4.43-21.oe1.x86_64.rpm"
    ],
    "aarch64": [
        "mod_md-2.4.43-21.oe1.aarch64.rpm",
        "httpd-devel-2.4.43-21.oe1.aarch64.rpm",
        "mod_session-2.4.43-21.oe1.aarch64.rpm",
        "mod_ssl-2.4.43-21.oe1.aarch64.rpm",
        "httpd-tools-2.4.43-21.oe1.aarch64.rpm",
        "httpd-debugsource-2.4.43-21.oe1.aarch64.rpm",
        "mod_ldap-2.4.43-21.oe1.aarch64.rpm",
        "httpd-2.4.43-21.oe1.aarch64.rpm",
        "mod_proxy_html-2.4.43-21.oe1.aarch64.rpm",
        "httpd-debuginfo-2.4.43-21.oe1.aarch64.rpm"
    ],
    "noarch": [
        "httpd-filesystem-2.4.43-21.oe1.noarch.rpm",
        "httpd-help-2.4.43-21.oe1.noarch.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / httpd

Package

Name
httpd
Purl
pkg:rpm/openEuler/httpd&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.43-21.oe1

Ecosystem specific 

{
    "src": [
        "httpd-2.4.43-21.oe1.src.rpm"
    ],
    "x86_64": [
        "mod_proxy_html-2.4.43-21.oe1.x86_64.rpm",
        "httpd-2.4.43-21.oe1.x86_64.rpm",
        "httpd-tools-2.4.43-21.oe1.x86_64.rpm",
        "httpd-debugsource-2.4.43-21.oe1.x86_64.rpm",
        "mod_ldap-2.4.43-21.oe1.x86_64.rpm",
        "mod_session-2.4.43-21.oe1.x86_64.rpm",
        "httpd-debuginfo-2.4.43-21.oe1.x86_64.rpm",
        "mod_md-2.4.43-21.oe1.x86_64.rpm",
        "mod_ssl-2.4.43-21.oe1.x86_64.rpm",
        "httpd-devel-2.4.43-21.oe1.x86_64.rpm"
    ],
    "aarch64": [
        "mod_md-2.4.43-21.oe1.aarch64.rpm",
        "httpd-2.4.43-21.oe1.aarch64.rpm",
        "httpd-devel-2.4.43-21.oe1.aarch64.rpm",
        "httpd-tools-2.4.43-21.oe1.aarch64.rpm",
        "mod_ldap-2.4.43-21.oe1.aarch64.rpm",
        "httpd-debugsource-2.4.43-21.oe1.aarch64.rpm",
        "mod_proxy_html-2.4.43-21.oe1.aarch64.rpm",
        "mod_session-2.4.43-21.oe1.aarch64.rpm",
        "httpd-debuginfo-2.4.43-21.oe1.aarch64.rpm",
        "mod_ssl-2.4.43-21.oe1.aarch64.rpm"
    ],
    "noarch": [
        "httpd-help-2.4.43-21.oe1.noarch.rpm",
        "httpd-filesystem-2.4.43-21.oe1.noarch.rpm"
    ]
}

openEuler:22.03-LTS / httpd

Package

Name
httpd
Purl
pkg:rpm/openEuler/httpd&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.51-15.oe2203sp1

Ecosystem specific 

{
    "src": [
        "httpd-2.4.51-15.oe2203.src.rpm",
        "httpd-2.4.51-15.oe2203sp1.src.rpm"
    ],
    "x86_64": [
        "mod_proxy_html-2.4.51-15.oe2203.x86_64.rpm",
        "httpd-devel-2.4.51-15.oe2203.x86_64.rpm",
        "httpd-2.4.51-15.oe2203.x86_64.rpm",
        "httpd-debuginfo-2.4.51-15.oe2203.x86_64.rpm",
        "mod_ssl-2.4.51-15.oe2203.x86_64.rpm",
        "mod_session-2.4.51-15.oe2203.x86_64.rpm",
        "mod_md-2.4.51-15.oe2203.x86_64.rpm",
        "mod_ldap-2.4.51-15.oe2203.x86_64.rpm",
        "httpd-tools-2.4.51-15.oe2203.x86_64.rpm",
        "httpd-debugsource-2.4.51-15.oe2203.x86_64.rpm",
        "mod_md-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-devel-2.4.51-15.oe2203sp1.x86_64.rpm",
        "mod_session-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-debuginfo-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-debugsource-2.4.51-15.oe2203sp1.x86_64.rpm",
        "mod_ldap-2.4.51-15.oe2203sp1.x86_64.rpm",
        "mod_proxy_html-2.4.51-15.oe2203sp1.x86_64.rpm",
        "mod_ssl-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-tools-2.4.51-15.oe2203sp1.x86_64.rpm"
    ],
    "aarch64": [
        "httpd-debuginfo-2.4.51-15.oe2203.aarch64.rpm",
        "httpd-tools-2.4.51-15.oe2203.aarch64.rpm",
        "httpd-debugsource-2.4.51-15.oe2203.aarch64.rpm",
        "mod_ssl-2.4.51-15.oe2203.aarch64.rpm",
        "mod_proxy_html-2.4.51-15.oe2203.aarch64.rpm",
        "mod_ldap-2.4.51-15.oe2203.aarch64.rpm",
        "mod_md-2.4.51-15.oe2203.aarch64.rpm",
        "httpd-2.4.51-15.oe2203.aarch64.rpm",
        "httpd-devel-2.4.51-15.oe2203.aarch64.rpm",
        "mod_session-2.4.51-15.oe2203.aarch64.rpm",
        "mod_proxy_html-2.4.51-15.oe2203sp1.aarch64.rpm",
        "mod_md-2.4.51-15.oe2203sp1.aarch64.rpm",
        "mod_ssl-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-devel-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-debuginfo-2.4.51-15.oe2203sp1.aarch64.rpm",
        "mod_session-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-debugsource-2.4.51-15.oe2203sp1.aarch64.rpm",
        "mod_ldap-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-tools-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-2.4.51-15.oe2203sp1.aarch64.rpm"
    ],
    "noarch": [
        "httpd-help-2.4.51-15.oe2203.noarch.rpm",
        "httpd-filesystem-2.4.51-15.oe2203.noarch.rpm",
        "httpd-filesystem-2.4.51-15.oe2203sp1.noarch.rpm",
        "httpd-help-2.4.51-15.oe2203sp1.noarch.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / httpd

Package

Name
httpd
Purl
pkg:rpm/openEuler/httpd&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.51-15.oe2203sp1

Ecosystem specific 

{
    "src": [
        "httpd-2.4.51-15.oe2203sp1.src.rpm"
    ],
    "x86_64": [
        "mod_md-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-devel-2.4.51-15.oe2203sp1.x86_64.rpm",
        "mod_session-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-debuginfo-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-debugsource-2.4.51-15.oe2203sp1.x86_64.rpm",
        "mod_ldap-2.4.51-15.oe2203sp1.x86_64.rpm",
        "mod_proxy_html-2.4.51-15.oe2203sp1.x86_64.rpm",
        "mod_ssl-2.4.51-15.oe2203sp1.x86_64.rpm",
        "httpd-tools-2.4.51-15.oe2203sp1.x86_64.rpm"
    ],
    "aarch64": [
        "mod_proxy_html-2.4.51-15.oe2203sp1.aarch64.rpm",
        "mod_md-2.4.51-15.oe2203sp1.aarch64.rpm",
        "mod_ssl-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-devel-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-debuginfo-2.4.51-15.oe2203sp1.aarch64.rpm",
        "mod_session-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-debugsource-2.4.51-15.oe2203sp1.aarch64.rpm",
        "mod_ldap-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-tools-2.4.51-15.oe2203sp1.aarch64.rpm",
        "httpd-2.4.51-15.oe2203sp1.aarch64.rpm"
    ],
    "noarch": [
        "httpd-filesystem-2.4.51-15.oe2203sp1.noarch.rpm",
        "httpd-help-2.4.51-15.oe2203sp1.noarch.rpm"
    ]
}