CVE-2010-2791: Infoleak
modproxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2791?
CVE-2010-2791 is considered a medium severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2010-2791?
To fix CVE-2010-2791, upgrade the Apache HTTP Server to version 2.2.10 or later.
Which versions of Apache HTTP Server are affected by CVE-2010-2791?
CVE-2010-2791 affects Apache HTTP Server version 2.2.9 when running on Unix.
Can CVE-2010-2791 be exploited remotely?
Yes, CVE-2010-2791 can be exploited remotely by attackers to retrieve sensitive information.
What does CVE-2010-2791 involve regarding backend connections?
CVE-2010-2791 involves an issue where mod_proxy does not close the backend connection after a timeout occurs, leading to possible information leakage.