PT-2024-40073 · Apache+1 · Apache+1

Published 2024-12-02 · Updated 2024-12-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: ibexa post-install versions prior to the patched versions

Description: The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to included platform.sh Varnish VCL templates and Apache/Nginx vhost templates enabling compression of API and JSON messages. To mitigate this, it is recommended to disable compression in these templates.

Recommendations: For all affected versions, disable HTTP compression for REST API requests and other communication that might contain secrets. Make sure to update your configuration files according to the release notes for specific instructions.

Note: The provided input does not specify the exact patched versions, so it is assumed that any version prior to the ones mentioned in the patches section is vulnerable.

Related Identifiers

GHSA-4H8F-C635-25P7

Affected Products

Apache

Nginx

References · 10

• https://osv.dev/vulnerability/GHSA-4h8f-c635-25p7 · Vendor Advisory
• https://github.com/ezsystems/ezplatform-http-cache/security/advisories/GHSA-mgfg-7533-7jf6 · Note
• https://github.com/ibexa/post-install · Note
• https://github.com/ibexa/post-install/commit/d91cc02623dd3263a99a94ace133c95e48909e5d · Note
• https://github.com/ibexa/post-install/security/advisories/GHSA-4h8f-c635-25p7 · Note
• https://github.com/ibexa/http-cache/security/advisories/GHSA-fh7v-q458-7vmw · Note
• https://doc.ibexa.co/en/latest/update_and_migration/from_3.3/update_from_3.3/#v3341 · Note
• https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614 · Note
• https://breachattack.com · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates · Note