PT-2023-2262 · Apache+10 · Apache Http Server+10

Dimas Fariski Setyawan Putra + 1 · Publicado 2023-01-29 · Atualizado 2025-05-15 · CVE-2023-27522

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.30 through 2.4.55 uWSGI PyPI package versions prior to 2.0.22

Description The issue is related to HTTP Response Smuggling vulnerability in Apache HTTP Server via mod proxy uwsgi. Special characters in the origin response header can truncate/split the response forwarded to the client. This can allow a remote attacker to perform an HTTP request smuggling attack.

Recommendations For Apache HTTP Server versions 2.4.30 through 2.4.55, update to a version that includes the fix for this issue. For uWSGI PyPI package versions prior to 2.0.22, update to version 2.0.22 or later. As a temporary workaround, consider disabling the mod proxy uwsgi module until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation.

Exploit

Correção

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

ALSA-2023:5050

ALSA-2023:6403

ALT-PU-2023-1402

ALT-PU-2023-1437

ALT-PU-2023-1452

ALT-PU-2023-2055

ALT-PU-2023-7559

ALT-PU-2024-10573

ALT-PU-2024-10796

ALT-PU-2024-10861

AZL-25606

BDU:2023-02021

BIT-APACHE-2023-27522

CESA-2023_5050

CVE-2023-27522

DLA-3401-1

DSA-5376-1

GHSA-VCPH-37MH-FQRH

MGASA-2023-0100

OESA-2023-1161

OPENSUSE-SU-2024:12776-1

OPENSUSE-SU-2024:13346-1

RHSA-2023:4629

RHSA-2023:5049

RHSA-2023:5050

RHSA-2023:6403

RHSA-2023_5050

RHSA-2023_6403

RHSA-2024:4504

RLSA-2023:5050

SUSE-SU-2023:0764-1

SUSE-SU-2023:0799-1

SUSE-SU-2023:1573-1

SUSE-SU-2023:1658-1

USN-5942-1

Produtos afetados

Alt Linux

Almalinux

Apache Http Server

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Referências · 89

• 🔥 https://github.com/dhmosfunk/CVE-2023-25690-POC · Exploit
• 🔥 https://github.com/thanhlam-attt/CVE-2023-25690 · Exploit
• https://github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2d · Nota
• https://github.com/unbit/uwsgi · Nota
• https://github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822 · Nota
• https://github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569 · Nota
• https://advisories.mageia.org/MGASA-2023-0100.html · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-25690 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2023-5050.html · Aviso do Fabricante
• https://httpd.apache.org/security/vulnerabilities_24.html · Aviso do Fabricante
• https://errata.rockylinux.org/RLSA-2023:5050 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02021 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2023:1573-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-27522.html · Nota
• https://osv.dev/vulnerability/ALSA-2023:5050 · Aviso do Fabricante