USN-6506-1: Apache HTTP Server vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• apache2 - Apache HTTP server

Details

David Shoon discovered that the Apache HTTP Server mod_macro module
incorrectly handled certain memory operations. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2023-31122)

Prof. Sven Dietrich, Isa Jafarov, Prof. Heejo Lee, and Choongin Lee
discovered that the Apache HTTP Server incorrectly handled certain HTTP/2
connections. A remote attacker could possibly use this issue to cause the
server to consume resources, leading to a denial of service. This issue
only affected Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-43622)

Will Dormann and David Warren discovered that the Apache HTTP Server
incorrectly handled memory when handling HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to consume
resources, leading to a denial of service. (CVE-2023-45802)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• apache2 - 2.4.57-2ubuntu2.1

Ubuntu 23.04

• apache2 - 2.4.55-1ubuntu2.1

Ubuntu 22.04

• apache2 - 2.4.52-1ubuntu4.7

Ubuntu 20.04

• apache2 - 2.4.41-4ubuntu3.15

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-45802
• CVE-2023-31122
• CVE-2023-43622

Related notices

• USN-6510-1: apache2-suexec, apache2-doc, apache2-dev, apache2-suexec-custom, libapache2-mod-macro, apache2-utils, libapache2-mod-proxy-html, apache2-mpm-event, apache2-data, apache2-mpm-prefork, apache2-mpm-worker, apache2, apache2-ssl-dev, apache2.2-bin, apache2-bin, apache2-suexec-pristine, apache2-mpm-itk