Bug 1222330 (CVE-2023-38709) - VUL-0: CVE-2023-38709: apache2: HTTP response splitting
Summary: VUL-0: CVE-2023-38709: apache2: HTTP response splitting
Status: NEW
Alias: CVE-2023-38709
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/400372/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-38709:6.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-04 15:16 UTC by SMASH SMASH
Modified: 2024-06-14 08:00 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-04 15:16:12 UTC
Posted by Eric Covener on Apr 04Affected versions:

- Apache HTTP Server through 2.4.58

Description:

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP 
responses.

This issue affects Apache HTTP Server: through 2.4.58.

Credit:

Orange Tsai (@orange_8361) from DEVCORE (finder)

References:

https://httpd.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-38709

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38709
https://seclists.org/oss-sec/2024/q2/29
https://www.cve.org/CVERecord?id=CVE-2023-38709
Comment 2 Petr Gajdos 2024-04-30 08:45:51 UTC
 *) SECURITY: CVE-2023-38709: Apache HTTP Server: HTTP response
     splitting (cve.mitre.org)
     Faulty input validation in the core of Apache allows malicious
     or exploitable backend/content generators to split HTTP
     responses.
     This issue affects Apache HTTP Server: through 2.4.58.
     Credits: Orange Tsai (@orange_8361) from DEVCORE

https://svn.apache.org/viewvc?view=revision&revision=1916778
Comment 4 Petr Gajdos 2024-04-30 14:05:00 UTC
Submitted for ALP,15sp4,15sp2,12sp5/apache2.

15sp6 and 12sp2 remains.
Comment 6 Petr Gajdos 2024-05-02 09:05:57 UTC
(In reply to Petr Gajdos from comment #4)
> 15sp6 and 12sp2 remains.

Submitted also for 12sp2.
Comment 7 Petr Gajdos 2024-05-02 09:08:36 UTC
home:pgajdos:apache-test:after/apache-test looks good.
Comment 10 Petr Gajdos 2024-05-13 09:27:46 UTC
SUSE:SLFO:Main
https://build.suse.de/request/show/329897
Comment 11 Maintenance Automation 2024-05-13 16:30:01 UTC
SUSE-SU-2024:1627-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1221401, 1222330, 1222332
CVE References: CVE-2023-38709, CVE-2024-24795, CVE-2024-27316
Maintenance Incident: [SUSE:Maintenance:33762](https://smelt.suse.de/incident/33762/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 apache2-tls13-2.4.51-35.41.1, apache2-2.4.51-35.41.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 apache2-tls13-2.4.51-35.41.1, apache2-2.4.51-35.41.1
SUSE Linux Enterprise Server 12 SP5 (src):
 apache2-tls13-2.4.51-35.41.1, apache2-2.4.51-35.41.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 apache2-tls13-2.4.51-35.41.1, apache2-2.4.51-35.41.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Maintenance Automation 2024-05-27 16:30:11 UTC
SUSE-SU-2024:1788-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1221401, 1222330, 1222332
CVE References: CVE-2023-38709, CVE-2024-24795, CVE-2024-27316
Maintenance Incident: [SUSE:Maintenance:33761](https://smelt.suse.de/incident/33761/)
Sources used:
SUSE Enterprise Storage 7.1 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 apache2-2.4.51-150200.3.62.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 apache2-2.4.51-150200.3.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Petr Gajdos 2024-05-28 06:45:02 UTC
15sp6
https://build.suse.de/request/show/331979

I believe all fixed.
Comment 14 Maintenance Automation 2024-06-10 12:30:02 UTC
SUSE-SU-2024:1963-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1221401, 1222330, 1222332
CVE References: CVE-2023-38709, CVE-2024-24795, CVE-2024-27316
Maintenance Incident: [SUSE:Maintenance:34076](https://smelt.suse.de/incident/34076/)
Sources used:
openSUSE Leap 15.6 (src):
 apache2-event-2.4.58-150600.5.3.1, apache2-utils-2.4.58-150600.5.3.1, apache2-test_worker-2.4.58-150600.5.3.1, apache2-2.4.58-150600.5.3.1, apache2-worker-2.4.58-150600.5.3.1, apache2-test_event-2.4.58-150600.5.3.1, apache2-devel-2.4.58-150600.5.3.1, apache2-test_prefork-2.4.58-150600.5.3.1, apache2-manual-2.4.58-150600.5.3.1, apache2-prefork-2.4.58-150600.5.3.1, apache2-test_main-2.4.58-150600.5.3.1, apache2-test_devel-2.4.58-150600.5.3.1
Basesystem Module 15-SP6 (src):
 apache2-2.4.58-150600.5.3.1, apache2-prefork-2.4.58-150600.5.3.1
SUSE Package Hub 15 15-SP6 (src):
 apache2-2.4.58-150600.5.3.1, apache2-event-2.4.58-150600.5.3.1
Server Applications Module 15-SP6 (src):
 apache2-utils-2.4.58-150600.5.3.1, apache2-worker-2.4.58-150600.5.3.1, apache2-devel-2.4.58-150600.5.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.