Test ID:	1.3.6.1.4.1.25623.1.1.10.2023.0032
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2023-0032)
Summary:	The remote host is missing an update for the 'apache' package(s) announced via the MGASA-2023-0032 advisory.
Description:	Summary: The remote host is missing an update for the 'apache' package(s) announced via the MGASA-2023-0032 advisory. Vulnerability Insight: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting. Prior to 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer) CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling. Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec at Qi'anxin Group CVE-2006-20001: mod_dav out of bounds read, or write of zero byte A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. Affected Software/OS: 'apache' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 7.6 CVSS Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-20001 https://security.gentoo.org/glsa/202309-01 https://httpd.apache.org/security/vulnerabilities_24.html Common Vulnerability Exposure (CVE) ID: CVE-2022-36760 Common Vulnerability Exposure (CVE) ID: CVE-2022-37436
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.